> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leen.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List IDP Alerts

> List all the IDP alerts for a given connection. sort - supports `severity:asc` (eg. lowest to highest criticality) and `severity:desc`. If no direction is provided it will default to `asc`



## OpenAPI

````yaml get /idp/alerts
openapi: 3.1.0
info:
  title: Leen Security API
  version: 0.0.1
servers:
  - description: Production API (US)
    url: https://api.leen.dev/v1
  - description: Production API (EU)
    url: https://api.eu-c1.leen.dev/v1
  - description: Production API (APAC)
    url: https://api.ap-se2.leen.dev/v1
security: []
paths:
  /idp/alerts:
    get:
      tags:
        - idp
      summary: List IDP Alerts
      description: >-
        List all the IDP alerts for a given connection. sort - supports
        `severity:asc` (eg. lowest to highest criticality) and `severity:desc`.
        If no direction is provided it will default to `asc`
      operationId: list_idp_alerts
      parameters:
        - description: >-
            Sort by a field, written as `field`, `field:asc` or `field:desc`.
            Which fields can be sorted on differs per endpoint.
          in: query
          name: sort
          required: false
          schema:
            anyOf:
              - pattern: ^severity$|^severity\:asc$|^severity\:desc$
                type: string
              - type: 'null'
            description: >-
              Sort by a field, written as `field`, `field:asc` or `field:desc`.
              Which fields can be sorted on differs per endpoint.
            title: Sort
        - description: >-
            Enable cursor based pagination instead of default offset-based
            pagination
          in: query
          name: enableCursor
          required: false
          schema:
            default: false
            description: >-
              Enable cursor based pagination instead of default offset-based
              pagination
            title: Enablecursor
            type: boolean
        - description: >-
            Only records whose `updated_at` is at or after this time. Leen bumps
            `updated_at` whenever any field on a record changes, so this is the
            filter for an incremental sync: it returns records that are new and
            records that changed, and nothing that has stood still. Example:
            `2021-01-01T00:00:00+00:00`.
          in: query
          name: updatedSince
          required: false
          schema:
            anyOf:
              - format: date-time
                type: string
              - type: 'null'
            description: >-
              Only records whose `updated_at` is at or after this time. Leen
              bumps `updated_at` whenever any field on a record changes, so this
              is the filter for an incremental sync: it returns records that are
              new and records that changed, and nothing that has stood still.
              Example: `2021-01-01T00:00:00+00:00`.
            examples:
              - '2021-01-01T00:00:00+00:00'
            title: Updatedsince
        - description: >-
            How many records to return per page. The walk is the same either
            way; a larger page means fewer round trips and more memory per
            response.
          in: query
          name: limit
          required: false
          schema:
            default: 100
            description: >-
              How many records to return per page. The walk is the same either
              way; a larger page means fewer round trips and more memory per
              response.
            maximum: 500
            minimum: 1
            title: Limit
            type: integer
        - description: >-
            Where to start, counted in records. Offset paging is stable only
            while the underlying data is; prefer the cursor for anything
            long-running.
          in: query
          name: offset
          required: false
          schema:
            default: 0
            description: >-
              Where to start, counted in records. Offset paging is stable only
              while the underlying data is; prefer the cursor for anything
              long-running.
            minimum: 0
            title: Offset
            type: integer
        - description: >-
            Skip counting the total. Counting is the expensive half of a large
            query, so set this when you are walking every page anyway and never
            read `total`. `total` comes back null.
          in: query
          name: excludeTotal
          required: false
          schema:
            default: false
            description: >-
              Skip counting the total. Counting is the expensive half of a large
              query, so set this when you are walking every page anyway and
              never read `total`. `total` comes back null.
            title: Excludetotal
            type: boolean
        - description: >-
            Opaque position of the next page, taken from the previous response.
            Ignore its contents; it encodes where the walk had reached.
          in: query
          name: cursor
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: >-
              Opaque position of the next page, taken from the previous
              response. Ignore its contents; it encodes where the walk had
              reached.
            title: Cursor
        - description: Severity filter, comma separated
          in: query
          name: severity
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Severity filter, comma separated
            examples:
              - critical,high
            title: Severity
      responses:
        '200':
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: >-
                      #/components/schemas/OffsetPaginatedResponse_ScopedIDPAlertRespModel_
                  - $ref: >-
                      #/components/schemas/KeySetPaginatedResponse_ScopedIDPAlertRespModel_
                title: Response List Idp Alerts
          description: Successful Response
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Unprocessable Content
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorException'
          description: Internal Server Error
      security:
        - API-Key: []
          Connection-ID: []
components:
  schemas:
    OffsetPaginatedResponse_ScopedIDPAlertRespModel_:
      properties:
        count:
          description: Number of items return in the response
          title: Count
          type: integer
        items:
          description: The records on this page.
          items:
            $ref: '#/components/schemas/ScopedIDPAlertRespModel'
          title: Items
          type: array
        total:
          anyOf:
            - type: integer
            - type: 'null'
          description: Total number of items that can be returned
          title: Total
      required:
        - count
        - items
      title: OffsetPaginatedResponse[ScopedIDPAlertRespModel]
      type: object
    KeySetPaginatedResponse_ScopedIDPAlertRespModel_:
      properties:
        items:
          description: The records on this page.
          items:
            $ref: '#/components/schemas/ScopedIDPAlertRespModel'
          title: Items
          type: array
        next_cursor:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Opaque position of the next page. Pass it back as `cursor` to
            continue; null when this is the last page.
          title: Next Cursor
        previous_cursor:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Opaque position of the previous page, for walking backwards. Null on
            the first page.
          title: Previous Cursor
      required:
        - items
      title: KeySetPaginatedResponse[ScopedIDPAlertRespModel]
      type: object
    ErrorResponse:
      properties:
        code:
          description: Error code
          title: Code
          type: string
        detail:
          description: List of error dictionaries
          items:
            additionalProperties: true
            type: object
          title: Detail
          type: array
        message:
          description: Error message
          title: Message
          type: string
        type:
          description: Type of error
          title: Type
          type: string
      required:
        - type
        - code
        - message
        - detail
      title: ErrorResponse
      type: object
    ErrorException:
      properties:
        detail:
          description: Error message
          title: Detail
          type: string
      required:
        - detail
      title: ErrorException
      type: object
    ScopedIDPAlertRespModel:
      properties:
        activity_id:
          anyOf:
            - type: integer
            - type: 'null'
          description: Activity ID of the alert
          title: Activity Id
        activity_name:
          anyOf:
            - type: string
            - type: 'null'
          description: Activity name of the alert
          title: Activity Name
        category_name:
          anyOf:
            - type: string
            - type: 'null'
          description: Category name of the alert
          title: Category Name
        category_uid:
          anyOf:
            - type: integer
            - type: 'null'
          description: Category UID of the alert
          title: Category Uid
        class_name:
          anyOf:
            - type: string
            - type: 'null'
          description: Class name of the alert
          title: Class Name
        class_uid:
          anyOf:
            - type: integer
            - type: 'null'
          description: Class UID of the alert
          title: Class Uid
        end_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time of the most recent event included in the finding.
          title: End Time
        enrichments:
          anyOf:
            - items:
                $ref: '#/components/schemas/OCSFEnrichment'
              type: array
            - type: 'null'
          description: Enrichments of the alert
          title: Enrichments
        evidences:
          anyOf:
            - items:
                $ref: '#/components/schemas/OCSFEvidence'
              type: array
            - type: 'null'
          description: Evidences of the alert
          title: Evidences
        finding_info:
          anyOf:
            - $ref: '#/components/schemas/OCSFFindingInfo'
            - type: 'null'
          description: Finding info of the alert
        id:
          description: Leen's identifier for this alert.
          format: uuid
          title: Id
          type: string
        message:
          anyOf:
            - type: string
            - type: 'null'
          description: Message of the alert
          title: Message
        metadata:
          anyOf:
            - $ref: '#/components/schemas/OCSFMetadata'
            - type: 'null'
          description: Metadata of the alert
        resources:
          anyOf:
            - items:
                $ref: '#/components/schemas/OCSFResourceDetails'
              type: array
            - type: 'null'
          description: >-
            Describes details about resources that were the target of the
            activity that triggered the finding
          title: Resources
        risk_details:
          anyOf:
            - type: string
            - type: 'null'
          description: Describes the risk associated with the finding.
          title: Risk Details
        risk_level:
          anyOf:
            - $ref: '#/components/schemas/ScopedIDPAlertRiskLevel'
            - type: 'null'
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          anyOf:
            - $ref: '#/components/schemas/ScopedIDPAlertRiskLevelID'
            - type: 'null'
          description: Risk level ID of the finding based on OCSF schema
        severity:
          anyOf:
            - $ref: '#/components/schemas/IDPAlertSeverity'
            - type: 'null'
          description: Severity name of the alert based on OCSF schema
        severity_id:
          anyOf:
            - $ref: '#/components/schemas/IDPAlertSeverityID'
            - type: 'null'
          description: Severity ID of the alert based on OCSF schema
        status:
          anyOf:
            - $ref: '#/components/schemas/ScopedIDPAlertStatus'
            - type: 'null'
          description: >-
            The normalized status of the Finding set by the consumer normalized
            to the caption of the status_id value. In the case of 'Other', it is
            defined by the source.
        status_id:
          anyOf:
            - $ref: '#/components/schemas/ScopedIDPAlertStatusID'
            - type: 'null'
          description: The normalized status identifier of the Finding
        time:
          description: Time of the alert
          format: date-time
          title: Time
          type: string
        type_name:
          $ref: '#/components/schemas/IDPAlertTypeName'
          description: Type name of the alert event/finding based on OCSF schema
        type_uid:
          $ref: '#/components/schemas/IDPAlertTypeUID'
          description: Type UID of the alert event/finding based on OCSF schema
      required:
        - id
        - time
        - end_time
      title: ScopedIDPAlertRespModel
      type: object
    OCSFEnrichment:
      properties:
        created_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the enrichment data was generated
          title: Created Time
        created_time_dt:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the enrichment data was generated
          title: Created Time Dt
        data:
          additionalProperties: true
          description: The enrichment data associated with the attribute and value
          title: Data
          type: object
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: A long description of the enrichment data
          title: Desc
        name:
          description: The name of the attribute to which the enriched data pertains
          title: Name
          type: string
        provider:
          anyOf:
            - type: string
            - type: 'null'
          description: The enrichment data provider name
          title: Provider
        reputation:
          anyOf:
            - $ref: '#/components/schemas/OCSFReputation'
            - type: 'null'
          description: The reputation of the enrichment data
        short_desc:
          anyOf:
            - type: string
            - type: 'null'
          description: A short description of the enrichment data
          title: Short Desc
        src_url:
          anyOf:
            - type: string
            - type: 'null'
          description: The URL of the source of the enrichment data
          title: Src Url
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: 'The enrichment type. For example: location'
          title: Type
        value:
          description: The value of the attribute to which the enriched data pertains
          title: Value
          type: string
      required:
        - name
        - value
        - data
      title: OCSFEnrichment
      type: object
    OCSFEvidence:
      properties:
        actor:
          anyOf:
            - $ref: '#/components/schemas/OCSFActor'
            - type: 'null'
          description: Details about the user/role/process that was the source
        api:
          anyOf:
            - $ref: '#/components/schemas/OCSFApi'
            - type: 'null'
          description: Details about the API call
        connection_info:
          anyOf:
            - $ref: '#/components/schemas/OCSFNetworkConnectionInfo'
            - type: 'null'
          description: Network connection information
        container:
          anyOf:
            - $ref: '#/components/schemas/OCSFContainer'
            - type: 'null'
          description: Container details
        data:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Additional evidence data not covered by other fields
          title: Data
        database:
          anyOf:
            - $ref: '#/components/schemas/OCSFDatabase'
            - type: 'null'
          description: Database details
        databucket:
          anyOf:
            - $ref: '#/components/schemas/OCSFDatabucket'
            - type: 'null'
          description: Databucket details
        device:
          anyOf:
            - $ref: '#/components/schemas/OCSFDevice'
            - type: 'null'
          description: Addressable device/computer system details
        dst_endpoint:
          anyOf:
            - $ref: '#/components/schemas/OCSFNetworkEndpoint'
            - type: 'null'
          description: Destination network endpoint details
        email:
          anyOf:
            - $ref: '#/components/schemas/OCSFEmail'
            - type: 'null'
          description: Email object details
        file:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: File details
          title: File
        job:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Scheduled job details
          title: Job
        process:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Process details
          title: Process
        query:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: DNS query details
          title: Query
        reg_key:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Registry key details (Windows-specific)
          title: Reg Key
        reg_value:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Registry value details (Windows-specific)
          title: Reg Value
        src_endpoint:
          anyOf:
            - $ref: '#/components/schemas/OCSFNetworkEndpoint'
            - type: 'null'
          description: Source network endpoint details
        url:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: URL object details
          title: Url
        user:
          anyOf:
            - $ref: '#/components/schemas/OCSFUser'
            - type: 'null'
          description: User details
        win_service:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Windows service details (Windows-specific)
          title: Win Service
      title: OCSFEvidence
      type: object
    OCSFFindingInfo:
      properties:
        analytic:
          anyOf:
            - $ref: '#/components/schemas/OCSFAnalytic'
            - type: 'null'
          description: >-
            The analytic technique used to analyze and derive insights from the
            data or information that led to the finding or conclusion
        attacks:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: >-
            The MITRE ATT&CK® technique and associated tactics related to the
            finding
          title: Attacks
        created_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the finding was created
          title: Created Time
        data_sources:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: A list of data sources utilized in generation of the finding
          title: Data Sources
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: The description of the reported finding
          title: Desc
        first_seen_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. It can differ from the
            created_time timestamp, which reflects the time this finding was
            created
          title: First Seen Time
        kill_chain:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: >-
            The Cyber Kill Chain® provides a detailed description of each phase
            and its associated activities within the broader context of a cyber
            attack
          title: Kill Chain
        last_seen_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. It can differ from
            the modified_time timestamp, which reflects the time this finding
            was last modified
          title: Last Seen Time
        modified_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the finding was last modified
          title: Modified Time
        product_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the product that reported the finding
          title: Product Uid
        related_analytics:
          anyOf:
            - items:
                $ref: '#/components/schemas/OCSFAnalytic'
              type: array
            - type: 'null'
          description: Other analytics related to this finding
          title: Related Analytics
        related_events:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: >-
            Describes events and/or other findings related to the finding as
            identified by the security product
          title: Related Events
        src_url:
          anyOf:
            - type: string
            - type: 'null'
          description: The URL pointing to the source of the finding
          title: Src Url
        title:
          description: A title or a brief phrase summarizing the reported finding
          title: Title
          type: string
        types:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: One or more types of the reported finding
          title: Types
        uid:
          description: The unique identifier of the reported finding
          title: Uid
          type: string
      required:
        - title
        - uid
      title: OCSFFindingInfo
      type: object
    OCSFMetadata:
      properties:
        correlation_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier used to correlate events
          title: Correlation Uid
        event_code:
          anyOf:
            - type: string
            - type: 'null'
          description: The Event ID or Code that the product uses to describe the event
          title: Event Code
        extensions:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: The schema extensions used to create the event
          title: Extensions
        labels:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: >-
            The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time
          title: Labels
        log_level:
          anyOf:
            - type: string
            - type: 'null'
          description: The audit level at which an event was generated
          title: Log Level
        log_name:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security
          title: Log Name
        log_provider:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing
          title: Log Provider
        log_version:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version
          title: Log Version
        logged_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the logging system collected and logged the event
          title: Logged Time
        loggers:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination
          title: Loggers
        modified_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the event was last modified or enriched
          title: Modified Time
        original_time:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs
          title: Original Time
        processed_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The event processed time, such as an ETL operation
          title: Processed Time
        product:
          $ref: '#/components/schemas/OCSFProduct'
          description: The product that reported the event
        profiles:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their name attribute for core profiles, or
            extension/name for profiles from extensions
          title: Profiles
        sequence:
          anyOf:
            - type: integer
            - type: 'null'
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision
          title: Sequence
        tenant_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique tenant identifier
          title: Tenant Uid
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The logging system-assigned unique identifier of an event instance
          title: Uid
        version:
          default: 1.3.0
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (SemVer). For example: 1.0.0. Event consumers use the
            version to determine the available event attributes
          title: Version
          type: string
      required:
        - product
      title: OCSFMetadata
      type: object
    OCSFResourceDetails:
      properties:
        agent_list:
          anyOf:
            - items:
                $ref: '#/components/schemas/OCSFAgent'
              type: array
            - type: 'null'
          description: A list of agents associated with the resource.
          title: Agent List
        criticality:
          anyOf:
            - type: string
            - type: 'null'
          description: The criticality level of the resource.
          title: Criticality
        data:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Additional data related to the resource.
          title: Data
        group:
          anyOf:
            - $ref: '#/components/schemas/OCSFGroup'
            - type: 'null'
          description: The group associated with the resource.
        labels:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: Labels or tags associated with the resource.
          title: Labels
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the resource.
          title: Name
        namespace:
          anyOf:
            - type: string
            - type: 'null'
          description: The namespace the resource belongs to.
          title: Namespace
        owner:
          anyOf:
            - $ref: '#/components/schemas/OCSFUser'
            - type: 'null'
          description: The owner of the resource.
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: The type of the resource.
          title: Type
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the resource.
          title: Uid
        version:
          anyOf:
            - type: string
            - type: 'null'
          description: The version of the resource.
          title: Version
      title: OCSFResourceDetails
      type: object
    ScopedIDPAlertRiskLevel:
      enum:
        - Unknown
        - Info
        - Low
        - Medium
        - High
        - Critical
        - Other
      title: ScopedIDPAlertRiskLevel
      type: string
    ScopedIDPAlertRiskLevelID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 99
      title: ScopedIDPAlertRiskLevelID
      type: integer
    IDPAlertSeverity:
      enum:
        - UNKNOWN
        - INFORMATIONAL
        - LOW
        - MEDIUM
        - HIGH
        - CRITICAL
        - FATAL
        - OTHER
      title: IDPAlertSeverity
      type: string
    IDPAlertSeverityID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 99
      title: IDPAlertSeverityID
      type: integer
    ScopedIDPAlertStatus:
      enum:
        - Unknown
        - New
        - In Progress
        - Suppressed
        - Resolved
        - Other
      title: ScopedIDPAlertStatus
      type: string
    ScopedIDPAlertStatusID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 99
      title: ScopedIDPAlertStatusID
      type: integer
    IDPAlertTypeName:
      enum:
        - 'Detection Finding: Unknown'
        - 'Detection Finding: Create'
        - 'Detection Finding: Update'
        - 'Detection Finding: Close'
        - 'Detection Finding: Other'
      title: IDPAlertTypeName
      type: string
    IDPAlertTypeUID:
      enum:
        - 200400
        - 200401
        - 200402
        - 200403
        - 200499
      title: IDPAlertTypeUID
      type: integer
    OCSFReputation:
      properties:
        base_score:
          description: The reputation score as reported by the event source
          title: Base Score
          type: number
        provider:
          anyOf:
            - type: string
            - type: 'null'
          description: The provider of the reputation information
          title: Provider
        score:
          anyOf:
            - $ref: '#/components/schemas/OCSFReputationScore'
            - type: 'null'
          description: >-
            The reputation score, normalized to the caption of the score_id
            value
        score_id:
          $ref: '#/components/schemas/OCSFReputationScoreID'
          description: The normalized reputation score identifier
      required:
        - base_score
        - score_id
      title: OCSFReputation
      type: object
    OCSFActor:
      properties:
        app_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The client application or service that initiated the activity
          title: App Name
        app_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The unique identifier of the client application or service that
            initiated the activity
          title: App Uid
        authorizations:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies
          title: Authorizations
        idp:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Details about the Identity Provider used
          title: Idp
        invoked_by:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The name of the service that invoked the activity (Deprecated since
            v1.2.0)
          title: Invoked By
        process:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The process that initiated the activity
          title: Process
        session:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The user session from which the activity was initiated
          title: Session
        user:
          anyOf:
            - $ref: '#/components/schemas/OCSFUser'
            - type: 'null'
          description: The user that initiated the activity or the user context
      title: OCSFActor
      type: object
    OCSFApi:
      properties:
        group:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The information pertaining to the API group
          title: Group
        operation:
          description: Verb/Operation associated with the request
          title: Operation
          type: string
        request:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Details pertaining to the API request
          title: Request
        response:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Details pertaining to the API response
          title: Response
        service:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The information pertaining to the API service
          title: Service
        version:
          anyOf:
            - type: string
            - type: 'null'
          description: The version of the API service
          title: Version
      required:
        - operation
      title: OCSFApi
      type: object
    OCSFNetworkConnectionInfo:
      properties:
        boundary:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The boundary of the connection, normalized to the caption of
            'boundary_id'
          title: Boundary
        boundary_id:
          anyOf:
            - $ref: '#/components/schemas/OCSFNetworkConnectionBoundaryID'
            - type: 'null'
          description: The normalized identifier of the boundary of the connection
        direction:
          anyOf:
            - type: string
            - type: 'null'
          description: The direction of the initiated connection, traffic, or email
          title: Direction
        direction_id:
          $ref: '#/components/schemas/OCSFNetworkConnectionDirectionID'
          description: >-
            The normalized identifier of the direction of the initiated
            connection, traffic, or email
        protocol_name:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The TCP/IP protocol name in lowercase, as defined by IANA. For
            example: tcp or udp
          title: Protocol Name
        protocol_num:
          anyOf:
            - type: integer
            - type: 'null'
          description: >-
            The TCP/IP protocol number, as defined by IANA. Use -1 if not
            defined by IANA
          title: Protocol Num
        protocol_ver:
          anyOf:
            - type: string
            - type: 'null'
          description: The Internet Protocol version
          title: Protocol Ver
        protocol_ver_id:
          anyOf:
            - $ref: '#/components/schemas/OCSFNetworkConnectionProtocolVerID'
            - type: 'null'
          description: The Internet Protocol version identifier
        session:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The authenticated user or service session
          title: Session
        tcp_flags:
          anyOf:
            - type: integer
            - type: 'null'
          description: The network connection TCP header flags (i.e., control bits)
          title: Tcp Flags
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the connection
          title: Uid
      required:
        - direction_id
      title: OCSFNetworkConnectionInfo
      type: object
    OCSFContainer:
      properties:
        hash:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container
          title: Hash
        image:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The container image used as a template to run the container
          title: Image
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The container name
          title: Name
        network_driver:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc
          title: Network Driver
        orchestrator:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift
          title: Orchestrator
        pod_uuid:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on
          title: Pod Uuid
        runtime:
          anyOf:
            - type: string
            - type: 'null'
          description: The backend running the container, such as containerd or cri-o
          title: Runtime
        size:
          anyOf:
            - type: integer
            - type: 'null'
          description: The size of the container image
          title: Size
        tag:
          anyOf:
            - type: string
            - type: 'null'
          description: The tag used by the container. It can indicate version, format, OS
          title: Tag
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The full container unique identifier for this instantiation of the
            container
          title: Uid
      title: OCSFContainer
      type: object
    OCSFDatabase:
      properties:
        created_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the database was known to have been created
          title: Created Time
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: The description of the database
          title: Desc
        groups:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: The group names to which the database belongs
          title: Groups
        modified_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the database
          title: Modified Time
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The database name, ordinarily as assigned by a database
            administrator
          title: Name
        size:
          anyOf:
            - type: integer
            - type: 'null'
          description: The size of the database in bytes
          title: Size
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: The database type
          title: Type
        type_id:
          $ref: '#/components/schemas/OCSFDatabaseTypeID'
          description: The normalized identifier of the database type
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the database
          title: Uid
      required:
        - type_id
      title: OCSFDatabase
      type: object
    OCSFDatabucket:
      properties:
        created_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the databucket was known to have been created
          title: Created Time
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: The description of the databucket
          title: Desc
        file:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: A file within a databucket
          title: File
        groups:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: The group names to which the databucket belongs
          title: Groups
        modified_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the databucket
          title: Modified Time
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The databucket name
          title: Name
        size:
          anyOf:
            - type: integer
            - type: 'null'
          description: The size of the databucket in bytes
          title: Size
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: The databucket type
          title: Type
        type_id:
          $ref: '#/components/schemas/OCSFDatabucketTypeID'
          description: The normalized identifier of the databucket type
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the databucket
          title: Uid
      required:
        - type_id
      title: OCSFDatabucket
      type: object
    OCSFDevice:
      properties:
        agent_list:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource
          title: Agent List
        autoscale_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the cloud autoscale configuration
          title: Autoscale Uid
        boot_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time the system was booted
          title: Boot Time
        created_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the device was known to have been created
          title: Created Time
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The description of the device, ordinarily as reported by the
            operating system
          title: Desc
        domain:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The network domain where the device resides. For example:
            work.example.com
          title: Domain
        first_seen_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The initial discovery time of the device
          title: First Seen Time
        groups:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: >-
            The group names to which the device belongs. For example: ["Windows
            Laptops", "Engineering"]
          title: Groups
        hostname:
          anyOf:
            - type: string
            - type: 'null'
          description: The device hostname
          title: Hostname
        hw_info:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The endpoint hardware information
          title: Hw Info
        hypervisor:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The name of the hypervisor running on the device. For example, Xen,
            VMware, Hyper-V, VirtualBox, etc
          title: Hypervisor
        image:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The image used as a template to run the virtual machine
          title: Image
        imei:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device
          title: Imei
        instance_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of a VM instance
          title: Instance Uid
        interface_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the network interface (e.g. eth2)
          title: Interface Name
        interface_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the network interface
          title: Interface Uid
        ip:
          anyOf:
            - type: string
            - type: 'null'
          description: The device IP address, in either IPv4 or IPv6 format
          title: Ip
        is_compliant:
          anyOf:
            - type: boolean
            - type: 'null'
          description: The event occurred on a compliant device
          title: Is Compliant
        is_managed:
          anyOf:
            - type: boolean
            - type: 'null'
          description: The event occurred on a managed device
          title: Is Managed
        is_personal:
          anyOf:
            - type: boolean
            - type: 'null'
          description: The event occurred on a personal device
          title: Is Personal
        is_trusted:
          anyOf:
            - type: boolean
            - type: 'null'
          description: The event occurred on a trusted device
          title: Is Trusted
        last_seen_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The most recent discovery time of the device
          title: Last Seen Time
        location:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The geographical location of the device
          title: Location
        mac:
          anyOf:
            - type: string
            - type: 'null'
          description: The Media Access Control (MAC) address of the endpoint
          title: Mac
        modified_time:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          description: The time when the device was last known to have been modified
          title: Modified Time
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator
          title: Name
        network_interfaces:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: The network interfaces that are associated with the device
          title: Network Interfaces
        org:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: Organization and org unit related to the device
          title: Org
        os:
          anyOf:
            - $ref: '#/components/schemas/OCSFOS'
            - type: 'null'
          description: The endpoint operating system
        owner:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it
          title: Owner
        region:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region
          title: Region
        risk_level:
          anyOf:
            - type: string
            - type: 'null'
          description: The risk level, normalized to the caption of the risk_level_id value
          title: Risk Level
        risk_level_id:
          anyOf:
            - type: integer
            - type: 'null'
          description: The normalized risk level id
          title: Risk Level Id
        risk_score:
          anyOf:
            - type: integer
            - type: 'null'
          description: The risk score as reported by the event source
          title: Risk Score
        subnet:
          anyOf:
            - type: string
            - type: 'null'
          description: The subnet mask
          title: Subnet
        subnet_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of a virtual subnet
          title: Subnet Uid
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The device type. For example: unknown, server, desktop, laptop,
            tablet, mobile, virtual, browser, or other
          title: Type
        type_id:
          $ref: '#/components/schemas/OCSFDeviceTypeID'
          description: The device type ID
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN
          title: Uid
        uid_alt:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN
          title: Uid Alt
        vlan_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the Virtual LAN (VLAN)
          title: Vlan Uid
        vpc_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the Virtual Private Cloud (VPC)
          title: Vpc Uid
        zone:
          anyOf:
            - type: string
            - type: 'null'
          description: The network zone or LAN segment
          title: Zone
      required:
        - type_id
      title: OCSFDevice
      type: object
    OCSFNetworkEndpoint:
      properties:
        agent_list:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource
          title: Agent List
        autonomous_system:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The Autonomous System details associated with an IP address
          title: Autonomous System
        container:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The information describing an instance of a container
          title: Container
        domain:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the domain
          title: Domain
        hostname:
          anyOf:
            - type: string
            - type: 'null'
          description: The fully qualified name of the endpoint
          title: Hostname
        hw_info:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The endpoint hardware information
          title: Hw Info
        instance_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of a VM instance
          title: Instance Uid
        interface_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the network interface (e.g. eth2)
          title: Interface Name
        interface_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the network interface
          title: Interface Uid
        intermediate_ips:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header
          title: Intermediate Ips
        ip:
          anyOf:
            - type: string
            - type: 'null'
          description: The IP address of the endpoint, in either IPv4 or IPv6 format
          title: Ip
        location:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The geographical location of the endpoint
          title: Location
        mac:
          anyOf:
            - type: string
            - type: 'null'
          description: The Media Access Control (MAC) address of the endpoint
          title: Mac
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The short name of the endpoint
          title: Name
        namespace_pid:
          anyOf:
            - type: integer
            - type: 'null'
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace
          title: Namespace Pid
        os:
          anyOf:
            - $ref: '#/components/schemas/OCSFOS'
            - type: 'null'
          description: The endpoint operating system
        owner:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it
          title: Owner
        port:
          anyOf:
            - type: integer
            - type: 'null'
          description: The port used for communication within the network connection
          title: Port
        proxy_endpoint:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The network proxy information pertaining to a specific endpoint
          title: Proxy Endpoint
        subnet_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of a virtual subnet
          title: Subnet Uid
        svc_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The service name in service-to-service connections
          title: Svc Name
        type:
          anyOf:
            - $ref: '#/components/schemas/OCSFNetworkEndpointTypeName'
            - type: 'null'
          description: >-
            The network endpoint type. For example: unknown, server, desktop,
            laptop, tablet, mobile, virtual, browser, or other
        type_id:
          anyOf:
            - $ref: '#/components/schemas/OCSFNetworkEndpointTypeID'
            - type: 'null'
          description: The network endpoint type ID
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the endpoint
          title: Uid
        vlan_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The Virtual LAN identifier
          title: Vlan Uid
        vpc_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the Virtual Private Cloud (VPC)
          title: Vpc Uid
        zone:
          anyOf:
            - type: string
            - type: 'null'
          description: The network zone or LAN segment
          title: Zone
      title: OCSFNetworkEndpoint
      type: object
    OCSFEmail:
      properties:
        cc:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: The email header Cc values, as defined by RFC 5322
          title: Cc
        delivered_to:
          anyOf:
            - type: string
            - type: 'null'
          description: The Delivered-To email header field
          title: Delivered To
        from:
          description: The email header From values, as defined by RFC 5322
          title: From
          type: string
        message_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The email header Message-Id value, as defined by RFC 5322
          title: Message Uid
        raw_header:
          anyOf:
            - type: string
            - type: 'null'
          description: The email authentication header
          title: Raw Header
        reply_to:
          anyOf:
            - type: string
            - type: 'null'
          description: The email header Reply-To values, as defined by RFC 5322
          title: Reply To
        size:
          anyOf:
            - type: integer
            - type: 'null'
          description: The size in bytes of the email, including attachments
          title: Size
        smtp_from:
          anyOf:
            - type: string
            - type: 'null'
          description: The value of the SMTP MAIL FROM command
          title: Smtp From
        smtp_to:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: The value of the SMTP envelope RCPT TO command
          title: Smtp To
        subject:
          anyOf:
            - type: string
            - type: 'null'
          description: The email header Subject value, as defined by RFC 5322
          title: Subject
        to:
          description: The email header To values, as defined by RFC 5322
          items:
            type: string
          title: To
          type: array
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The email unique identifier
          title: Uid
        x_originating_ip:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es)
          title: X Originating Ip
      required:
        - from
        - to
      title: OCSFEmail
      type: object
    OCSFUser:
      properties:
        account:
          anyOf:
            - $ref: '#/components/schemas/OCSFAccount'
            - type: 'null'
          description: The user's account or the account associated with the user
        credential_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID
          title: Credential Uid
        domain:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain
          title: Domain
        email_addr:
          anyOf:
            - type: string
            - type: 'null'
          description: The user's primary email address
          title: Email Addr
        full_name:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn)
          title: Full Name
        groups:
          anyOf:
            - items:
                $ref: '#/components/schemas/OCSFGroup'
              type: array
            - type: 'null'
          description: The administrative groups to which the user belongs
          title: Groups
        ldap_person:
          anyOf:
            - $ref: '#/components/schemas/OCSFLdapPerson'
            - type: 'null'
          description: The additional LDAP attributes that describe a person
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The username. For example, janedoe1
          title: Name
        org:
          anyOf:
            - $ref: '#/components/schemas/OCSFOrganization'
            - type: 'null'
          description: Organization and org unit related to the user
        risk_level:
          anyOf:
            - $ref: '#/components/schemas/OCSFUserRiskLevel'
            - type: 'null'
          description: The risk level, normalized to the caption of the risk_level_id value
        risk_level_id:
          anyOf:
            - $ref: '#/components/schemas/OCSFUserRiskLevelID'
            - type: 'null'
          description: The normalized risk level id
        risk_score:
          anyOf:
            - type: integer
            - type: 'null'
          description: The risk score as reported by the event source
          title: Risk Score
        type:
          anyOf:
            - $ref: '#/components/schemas/OCSFUserType'
            - type: 'null'
          description: The type of the user. For example, System, AWS IAM User, etc
        type_id:
          anyOf:
            - $ref: '#/components/schemas/OCSFUserTypeID'
            - type: 'null'
          description: The account type identifier
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN
          title: Uid
        uid_alt:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID
          title: Uid Alt
      title: OCSFUser
      type: object
    OCSFAnalytic:
      properties:
        category:
          anyOf:
            - type: string
            - type: 'null'
          description: The analytic category
          title: Category
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: The description of the analytic that generated the finding
          title: Desc
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the analytic that generated the finding
          title: Name
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: The analytic type
          title: Type
        type_id:
          $ref: '#/components/schemas/OCSFAnalyticTypeID'
          description: The analytic type ID
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the analytic that generated the finding
          title: Uid
        version:
          anyOf:
            - type: string
            - type: 'null'
          description: 'The analytic version. For example: 1.1'
          title: Version
      required:
        - type_id
      title: OCSFAnalytic
      type: object
    OCSFProduct:
      properties:
        cpe_name:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The Common Platform Enumeration (CPE) name as described by (NIST)
            For example: cpe:/a:apple:safari:16.2
          title: Cpe Name
        feature:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          description: The feature that reported the event
          title: Feature
        lang:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The two letter lower case language codes, as defined by ISO 639-1.
            For example: en (English), de (German), or fr (French)
          title: Lang
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the product
          title: Name
        path:
          anyOf:
            - type: string
            - type: 'null'
          description: The installation path of the product
          title: Path
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the product
          title: Uid
        url_string:
          anyOf:
            - type: string
            - type: 'null'
          description: The URL pointing towards the product
          title: Url String
        vendor_name:
          description: The name of the vendor of the product
          title: Vendor Name
          type: string
        version:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The version of the product, as defined by the event source. For
            example: 2013.1.3-beta
          title: Version
      required:
        - vendor_name
      title: OCSFProduct
      type: object
    OCSFAgent:
      properties:
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the agent.
          title: Name
        policies:
          anyOf:
            - items:
                $ref: '#/components/schemas/OCSFPolicy'
              type: array
            - type: 'null'
          description: A list of policies associated with the agent.
          title: Policies
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: The type of the agent.
          title: Type
        type_id:
          anyOf:
            - $ref: '#/components/schemas/OCSFAgentType'
            - type: 'null'
          description: The type identifier for the agent.
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the agent.
          title: Uid
        uid_alt:
          anyOf:
            - type: string
            - type: 'null'
          description: An alternate identifier for the agent.
          title: Uid Alt
        vendor_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the agent vendor.
          title: Vendor Name
        version:
          anyOf:
            - type: string
            - type: 'null'
          description: The version of the agent.
          title: Version
      title: OCSFAgent
      type: object
    OCSFGroup:
      properties:
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: A description of the group.
          title: Desc
        domain:
          anyOf:
            - type: string
            - type: 'null'
          description: The domain associated with the group.
          title: Domain
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the group.
          title: Name
        privileges:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: Privileges associated with the group.
          title: Privileges
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: The type of the group.
          title: Type
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the group.
          title: Uid
      title: OCSFGroup
      type: object
    OCSFReputationScore:
      description: String representation of reputation scores
      enum:
        - UNKNOWN
        - VERY_SAFE
        - SAFE
        - PROBABLY_SAFE
        - LEANS_SAFE
        - MAY_NOT_BE_SAFE
        - EXERCISE_CAUTION
        - SUSPICIOUS_RISKY
        - POSSIBLY_MALICIOUS
        - PROBABLY_MALICIOUS
        - MALICIOUS
        - OTHER
      title: OCSFReputationScore
      type: string
    OCSFReputationScoreID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 99
      title: OCSFReputationScoreID
      type: integer
    OCSFNetworkConnectionBoundaryID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 11
        - 99
      title: OCSFNetworkConnectionBoundaryID
      type: integer
    OCSFNetworkConnectionDirectionID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 99
      title: OCSFNetworkConnectionDirectionID
      type: integer
    OCSFNetworkConnectionProtocolVerID:
      enum:
        - 0
        - 4
        - 6
        - 99
      title: OCSFNetworkConnectionProtocolVerID
      type: integer
    OCSFDatabaseTypeID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 99
      title: OCSFDatabaseTypeID
      type: integer
    OCSFDatabucketTypeID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 99
      title: OCSFDatabucketTypeID
      type: integer
    OCSFOS:
      properties:
        build:
          anyOf:
            - type: string
            - type: 'null'
          description: The operating system build number
          title: Build
        country:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code)
          title: Country
        cpe_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The Common Platform Enumeration (CPE) name as described by (NIST)
          title: Cpe Name
        cpu_bits:
          anyOf:
            - type: integer
            - type: 'null'
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: 32 or 64
          title: Cpu Bits
        edition:
          anyOf:
            - type: string
            - type: 'null'
          description: 'The operating system edition. For example: Professional'
          title: Edition
        lang:
          anyOf:
            - type: string
            - type: 'null'
          description: The two letter lower case language codes, as defined by ISO 639-1
          title: Lang
        name:
          description: The operating system name
          title: Name
          type: string
        sp_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the latest Service Pack
          title: Sp Name
        sp_ver:
          anyOf:
            - type: integer
            - type: 'null'
          description: The version number of the latest Service Pack
          title: Sp Ver
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: The type of the operating system
          title: Type
        type_id:
          $ref: '#/components/schemas/OCSFOSTypeID'
          description: The type identifier of the operating system
        version:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The version of the OS running on the device that originated the
            event
          title: Version
      required:
        - name
        - type_id
      title: OCSFOS
      type: object
    OCSFDeviceTypeID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 11
        - 12
        - 13
        - 14
        - 15
        - 99
      title: OCSFDeviceTypeID
      type: integer
    OCSFNetworkEndpointTypeName:
      enum:
        - Unknown
        - Server
        - Desktop
        - Laptop
        - Tablet
        - Mobile
        - Virtual
        - IOT
        - Browser
        - Firewall
        - Switch
        - Hub
        - Router
        - IDS
        - IPS
        - Load Balancer
        - Other
      title: OCSFNetworkEndpointTypeName
      type: string
    OCSFNetworkEndpointTypeID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 11
        - 12
        - 13
        - 14
        - 15
        - 99
      title: OCSFNetworkEndpointTypeID
      type: integer
    OCSFAccount:
      properties:
        labels:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: The list of labels/tags associated to the account
          title: Labels
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the account (e.g. GCP Account Name)
          title: Name
        type:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source
          title: Type
        type_id:
          anyOf:
            - $ref: '#/components/schemas/OCSFAccountTypeID'
            - type: 'null'
          description: The normalized account type identifier
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the account (e.g. AWS Account ID)
          title: Uid
      title: OCSFAccount
      type: object
    OCSFLdapPerson:
      properties:
        cost_center:
          anyOf:
            - type: string
            - type: 'null'
          description: The cost center associated with the person.
          title: Cost Center
        created_time:
          anyOf:
            - type: integer
            - type: 'null'
          description: The time the person was created, in Unix timestamp.
          title: Created Time
        created_time_dt:
          anyOf:
            - type: string
            - type: 'null'
          description: The time the person was created, in ISO 8601 format.
          title: Created Time Dt
        deleted_time:
          anyOf:
            - type: integer
            - type: 'null'
          description: The time the person was deleted, in Unix timestamp.
          title: Deleted Time
        deleted_time_dt:
          anyOf:
            - type: string
            - type: 'null'
          description: The time the person was deleted, in ISO 8601 format.
          title: Deleted Time Dt
        email_addrs:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: A list of email addresses for the person.
          title: Email Addrs
        employee_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The employee ID for the person.
          title: Employee Uid
        given_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The given name of the person.
          title: Given Name
        hire_time:
          anyOf:
            - type: integer
            - type: 'null'
          description: The time the person was hired, in Unix timestamp.
          title: Hire Time
        hire_time_dt:
          anyOf:
            - type: string
            - type: 'null'
          description: The time the person was hired, in ISO 8601 format.
          title: Hire Time Dt
        job_title:
          anyOf:
            - type: string
            - type: 'null'
          description: The job title of the person.
          title: Job Title
        labels:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          description: A list of labels associated with the person.
          title: Labels
        last_login_time:
          anyOf:
            - type: integer
            - type: 'null'
          description: The last login time of the person, in Unix timestamp.
          title: Last Login Time
        last_login_time_dt:
          anyOf:
            - type: string
            - type: 'null'
          description: The last login time of the person, in ISO 8601 format.
          title: Last Login Time Dt
        ldap_cn:
          anyOf:
            - type: string
            - type: 'null'
          description: The LDAP Common Name for the person.
          title: Ldap Cn
        ldap_dn:
          anyOf:
            - type: string
            - type: 'null'
          description: The LDAP Distinguished Name for the person.
          title: Ldap Dn
        leave_time:
          anyOf:
            - type: integer
            - type: 'null'
          description: The time the person left the organization, in Unix timestamp.
          title: Leave Time
        leave_time_dt:
          anyOf:
            - type: string
            - type: 'null'
          description: The time the person left the organization, in ISO 8601 format.
          title: Leave Time Dt
        location:
          anyOf:
            - $ref: '#/components/schemas/OCSFLocation'
            - type: 'null'
          description: The geographical location of the person.
        manager:
          anyOf:
            - $ref: '#/components/schemas/OCSFUser'
            - type: 'null'
          description: The manager of the person.
        modified_time:
          anyOf:
            - type: integer
            - type: 'null'
          description: The time the person was last modified, in Unix timestamp.
          title: Modified Time
        modified_time_dt:
          anyOf:
            - type: string
            - type: 'null'
          description: The time the person was last modified, in ISO 8601 format.
          title: Modified Time Dt
        office_location:
          anyOf:
            - type: string
            - type: 'null'
          description: The office location of the person.
          title: Office Location
        surname:
          anyOf:
            - type: string
            - type: 'null'
          description: The surname of the person.
          title: Surname
      title: OCSFLdapPerson
      type: object
    OCSFOrganization:
      properties:
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the organization.
          title: Name
        ou_name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the organizational unit.
          title: Ou Name
        ou_uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier for the organizational unit.
          title: Ou Uid
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier for the organization.
          title: Uid
      title: OCSFOrganization
      type: object
    OCSFUserRiskLevel:
      enum:
        - Info
        - Low
        - Medium
        - High
        - Critical
        - Other
      title: OCSFUserRiskLevel
      type: string
    OCSFUserRiskLevelID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 99
      title: OCSFUserRiskLevelID
      type: integer
    OCSFUserType:
      enum:
        - Unknown
        - User
        - Admin
        - System
        - Other
      title: OCSFUserType
      type: string
    OCSFUserTypeID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 99
      title: OCSFUserTypeID
      type: integer
    OCSFAnalyticTypeID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 11
        - 99
      title: OCSFAnalyticTypeID
      type: integer
    OCSFPolicy:
      properties:
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: A description of the policy.
          title: Desc
        group:
          anyOf:
            - $ref: '#/components/schemas/OCSFGroup'
            - type: 'null'
          description: The group associated with the policy.
        is_applied:
          anyOf:
            - type: boolean
            - type: 'null'
          description: Indicates whether the policy is applied.
          title: Is Applied
        name:
          anyOf:
            - type: string
            - type: 'null'
          description: The name of the policy.
          title: Name
        uid:
          anyOf:
            - type: string
            - type: 'null'
          description: The unique identifier of the policy.
          title: Uid
        version:
          anyOf:
            - type: string
            - type: 'null'
          description: The version of the policy.
          title: Version
      title: OCSFPolicy
      type: object
    OCSFAgentType:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 99
      title: OCSFAgentType
      type: integer
    OCSFOSTypeID:
      enum:
        - 0
        - 100
        - 101
        - 200
        - 201
        - 300
        - 301
        - 302
        - 400
        - 401
        - 402
        - 99
      title: OCSFOSTypeID
      type: integer
    OCSFAccountTypeID:
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 99
      title: OCSFAccountTypeID
      type: integer
    OCSFLocation:
      properties:
        city:
          anyOf:
            - type: string
            - type: 'null'
          description: The city where the location resides.
          title: City
        continent:
          anyOf:
            - type: string
            - type: 'null'
          description: The continent of the location.
          title: Continent
        coordinates:
          anyOf:
            - items:
                type: number
              type: array
            - type: 'null'
          description: The coordinates of the location as a latitude-longitude pair.
          title: Coordinates
        country:
          anyOf:
            - type: string
            - type: 'null'
          description: The country of the location.
          title: Country
        desc:
          anyOf:
            - type: string
            - type: 'null'
          description: A description of the location.
          title: Desc
        geohash:
          anyOf:
            - type: string
            - type: 'null'
          description: The geohash representing the location.
          title: Geohash
        is_on_premises:
          anyOf:
            - type: boolean
            - type: 'null'
          description: Whether the location is on premises.
          title: Is On Premises
        isp:
          anyOf:
            - type: string
            - type: 'null'
          description: The Internet Service Provider (ISP) for the location.
          title: Isp
        lat:
          anyOf:
            - type: number
            - type: 'null'
          description: The latitude of the location.
          title: Lat
        long:
          anyOf:
            - type: number
            - type: 'null'
          description: The longitude of the location.
          title: Long
        postal_code:
          anyOf:
            - type: string
            - type: 'null'
          description: The postal code of the location.
          title: Postal Code
        provider:
          anyOf:
            - type: string
            - type: 'null'
          description: The provider for the location.
          title: Provider
        region:
          anyOf:
            - type: string
            - type: 'null'
          description: The region where the location resides.
          title: Region
      title: OCSFLocation
      type: object
  securitySchemes:
    API-Key:
      in: header
      name: X-API-KEY
      type: apiKey
    Connection-ID:
      in: header
      name: X-CONNECTION-ID
      type: apiKey

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.