- Print
- DarkLight
Article summary
Did you find this summary helpful?
Thank you for your feedback
Caption | Name | Requirement | Type | Description |
---|---|---|---|---|
End Time | active | optional | :ref:`boolean_t <boolean_t>` | | Derived from OCSF ApplicationLifecycle.end_time. ApplicationLifecycle.end_time: The end time of a time period, or the time of the most recent event included in the aggregate event. |
Device ID | device_ids | optional | :ref:`json_t Array <json_t>` | | Derived from OCSF ApplicationLifecycle.device.id. ApplicationLifecycle.device: An addressable device, computer system or host. Device.id: The unique identifier used by DataBee for a specific device. This will be logged as ``device_id`` in activity tables to link to a particular device in this table. This field should not be mapped manually as the DataBee product populates this field itself. |
End Time | end_time | optional | :ref:`timestamp_t <timestamp_t>` | | Derived from OCSF ApplicationLifecycle.end_time. ApplicationLifecycle.end_time: The end time of a time period, or the time of the most recent event included in the aggregate event. |
Start Time | first_seen_time | optional | :ref:`timestamp_t <timestamp_t>` | | Derived from OCSF ApplicationLifecycle.start_time. ApplicationLifecycle.start_time: The start time of a time period, or the time of the least recent event included in the aggregate event. |
Application Vendor Name/Application Version/Application Name/Application Unique ID | id | required | :ref:`integer_t <integer_t>` | | Derived from OCSF ApplicationLifecycle.app.vendor_name and OCSF ApplicationLifecycle.app.version and OCSF ApplicationLifecycle.app.name and OCSF ApplicationLifecycle.app.uid. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.vendor_name: The name of the vendor of the product. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.version: The version of the product, as defined by the event source. For example: ``2013.1.3-beta``. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.name: The name of the product. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.uid: The unique identifier of the product. |
Application Name | name | required | :ref:`string_t <string_t>` | | Derived from OCSF ApplicationLifecycle.app.name. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.name: The name of the product. |
Application Owner | owners | optional | :ref:`json_t Array <json_t>` | | Derived from OCSF ApplicationLifecycle.app.owner. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.owner: The owner of the product. Typically this is the user responsible for the application internal to the organization. |
Record Created At | record_created_at | required | :ref:`timestamp_t <timestamp_t>` | | CDPs generated timestamp when record was created. |
Record Updated At | record_updated_at | required | :ref:`timestamp_t <timestamp_t>` | | CDPs generated timestamp when record was last updated. |
Application Name | sources | recommended | :ref:`string_t Array <string_t>` | | Derived from OCSF ApplicationLifecycle.app.name. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.name: The name of the product. |
Application Unique ID | uid | required | :ref:`string_t <string_t>` | | Derived from OCSF ApplicationLifecycle.app.uid. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.uid: The unique identifier of the product. |
Application URL String | url_string | optional | :ref:`string_t <string_t>` | | Derived from OCSF ApplicationLifecycle.app.url_string. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.url_string: The URL pointing towards the product. |
Application Vendor Name | vendor_name | required | :ref:`string_t <string_t>` | | Derived from OCSF ApplicationLifecycle.app.vendor_name. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.vendor_name: The name of the vendor of the product. |
Application Version | version | required | :ref:`string_t <string_t>` | | Derived from OCSF ApplicationLifecycle.app.version. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.version: The version of the product, as defined by the event source. For example: ``2013.1.3-beta``. |
Was this article helpful?