Showing:

Annotations
Diagrams
Source
Used by
Main schema Win_Event_Log_Object.xsd
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element WinEventLogObj:Windows_Event_Log
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The Windows_Event_Log object is intended to characterize entries in the Windows event log. Microsoft's Event schema is described at http://msdn.microsoft.com/en-us/library/aa385201 and the .NET API is described at http://msdn.microsoft.com/en-us/library/y80k1300.aspx.
Diagram
Diagram Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_EID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Type Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Log Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Message Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Category_Num Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Category Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Generation_Time Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Source Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Machine Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_User Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Blob Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Correlation_Activity_ID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Correlation_Related_Activity_ID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Execution_Process_ID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Execution_Thread_ID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Index Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Reserved Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Unformatted_Message_List Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Write_Time Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType
Type WinEventLogObj:WindowsEventLogObjectType
Type hierarchy
Children WinEventLogObj:Blob, WinEventLogObj:Category, WinEventLogObj:Category_Num, WinEventLogObj:Correlation_Activity_ID, WinEventLogObj:Correlation_Related_Activity_ID, WinEventLogObj:EID, WinEventLogObj:Execution_Process_ID, WinEventLogObj:Execution_Thread_ID, WinEventLogObj:Generation_Time, WinEventLogObj:Index, WinEventLogObj:Log, WinEventLogObj:Machine, WinEventLogObj:Message, WinEventLogObj:Reserved, WinEventLogObj:Source, WinEventLogObj:Type, WinEventLogObj:Unformatted_Message_List, WinEventLogObj:User, WinEventLogObj:Write_Time
Source
 
<xs:element name="Windows_Event_Log" type="WinEventLogObj:WindowsEventLogObjectType">
  <xs:annotation>
    <xs:documentation>The Windows_Event_Log object is intended to characterize entries in the Windows event log. Microsoft's Event schema is described at http://msdn.microsoft.com/en-us/library/aa385201 and the .NET API is described at http://msdn.microsoft.com/en-us/library/y80k1300.aspx.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:EID
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The EID field specifies the ID of the event for which the event log entry was created.
Diagram
Diagram
Type LongObjectPropertyType
Source
 
<xs:element name="EID" type="cyboxCommon:LongObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The EID field specifies the ID of the event for which the event log entry was created.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Type
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The event type associated with the entry in the event log, e.g., warning, information, error.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Type" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The event type associated with the entry in the event log, e.g., warning, information, error.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Log
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The name of the log.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Log" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The name of the log.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Message
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The rendered message string for the event.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Message" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The rendered message string for the event.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Category_Num
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The event entry's category number, as defined by the source.
Diagram
Diagram
Type LongObjectPropertyType
Source
 
<xs:element name="Category_Num" type="cyboxCommon:LongObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The event entry's category number, as defined by the source.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Category
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The text associated with Category_Num.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Category" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The text associated with Category_Num.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Generation_Time
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The Generation_Time field specifies the date/time the event was generated.
Diagram
Diagram
Type DateTimeObjectPropertyType
Source
 
<xs:element name="Generation_Time" type="cyboxCommon:DateTimeObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Generation_Time field specifies the date/time the event was generated.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Source
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
What logged the event, typically the name of an application or sub-component.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Source" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>What logged the event, typically the name of an application or sub-component.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Machine
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The name of the computer on which the event log entry was generated.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Machine" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The name of the computer on which the event log entry was generated.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:User
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The name of the user (the security ID) responsible for the event.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="User" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The name of the user (the security ID) responsible for the event.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Blob
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The event data as a binary blob.
Diagram
Diagram
Type Base64BinaryObjectPropertyType
Source
 
<xs:element name="Blob" type="cyboxCommon:Base64BinaryObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The event data as a binary blob.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Correlation_Activity_ID
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
A globally unique identifier that identifies the current activity.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Correlation_Activity_ID" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>A globally unique identifier that identifies the current activity.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Correlation_Related_Activity_ID
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
Diagram
Type StringObjectPropertyType
Source
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Execution_Process_ID
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The Execution_Process_ID field specifies the Process ID (PID) of the process which created the event.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Execution_Process_ID" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Execution_Process_ID field specifies the Process ID (PID) of the process which created the event.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Execution_Thread_ID
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The Execution_Thread_ID field specifies the Thread ID (TID) of the thread which created the event.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Execution_Thread_ID" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Execution_Thread_ID field specifies the Thread ID (TID) of the thread which created the event.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Index
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The index of the event entry in the log.
Diagram
Diagram
Type LongObjectPropertyType
Source
 
<xs:element name="Index" type="cyboxCommon:LongObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The index of the event entry in the log.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Reserved
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
A DWORD value that is always set to ELF_LOG_SIGNATURE (the value 0x654c664c), which is ASCII for eLfL.
Diagram
Diagram
Type LongObjectPropertyType
Source
 
<xs:element name="Reserved" type="cyboxCommon:LongObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>A DWORD value that is always set to ELF_LOG_SIGNATURE (the value 0x654c664c), which is ASCII for eLfL.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Unformatted_Message_List
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
List of unformatted messages in the event log entry.
Diagram
Diagram Win_Event_Log_Object_xsd.tmp#UnformattedMessageListType_Unformatted_Message Win_Event_Log_Object_xsd.tmp#UnformattedMessageListType
Type WinEventLogObj:UnformattedMessageListType
Children WinEventLogObj:Unformatted_Message
Source
 
<xs:element name="Unformatted_Message_List" type="WinEventLogObj:UnformattedMessageListType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>List of unformatted messages in the event log entry.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:UnformattedMessageListType / WinEventLogObj:Unformatted_Message
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
A single unformatted message in the event log entry.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element name="Unformatted_Message" type="cyboxCommon:StringObjectPropertyType" minOccurs="1" maxOccurs="unbounded">
  <xs:annotation>
    <xs:documentation>A single unformatted message in the event log entry.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinEventLogObj:WindowsEventLogObjectType / WinEventLogObj:Write_Time
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The Write_Time field specifies the date/time that the entry was written into the event log.
Diagram
Diagram
Type DateTimeObjectPropertyType
Source
 
<xs:element name="Write_Time" type="cyboxCommon:DateTimeObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Write_Time field specifies the date/time that the entry was written into the event log.</xs:documentation>
  </xs:annotation>
</xs:element>
Complex Type WinEventLogObj:WindowsEventLogObjectType
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The WindowsEventLogObjectType type is intended to characterize entries in the Windows event log.
Diagram
Diagram Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_EID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Type Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Log Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Message Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Category_Num Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Category Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Generation_Time Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Source Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Machine Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_User Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Blob Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Correlation_Activity_ID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Correlation_Related_Activity_ID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Execution_Process_ID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Execution_Thread_ID Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Index Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Reserved Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Unformatted_Message_List Win_Event_Log_Object_xsd.tmp#WindowsEventLogObjectType_Write_Time
Type extension of ObjectPropertiesType
Type hierarchy
Used by
Children WinEventLogObj:Blob, WinEventLogObj:Category, WinEventLogObj:Category_Num, WinEventLogObj:Correlation_Activity_ID, WinEventLogObj:Correlation_Related_Activity_ID, WinEventLogObj:EID, WinEventLogObj:Execution_Process_ID, WinEventLogObj:Execution_Thread_ID, WinEventLogObj:Generation_Time, WinEventLogObj:Index, WinEventLogObj:Log, WinEventLogObj:Machine, WinEventLogObj:Message, WinEventLogObj:Reserved, WinEventLogObj:Source, WinEventLogObj:Type, WinEventLogObj:Unformatted_Message_List, WinEventLogObj:User, WinEventLogObj:Write_Time
Source
 
<xs:complexType name="WindowsEventLogObjectType" mixed="false">
  <xs:annotation>
    <xs:documentation>The WindowsEventLogObjectType type is intended to characterize entries in the Windows event log.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="cyboxCommon:ObjectPropertiesType">
      <xs:sequence>
        <xs:element name="EID" type="cyboxCommon:LongObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The EID field specifies the ID of the event for which the event log entry was created.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Type" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The event type associated with the entry in the event log, e.g., warning, information, error.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Log" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The name of the log.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Message" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The rendered message string for the event.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Category_Num" type="cyboxCommon:LongObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The event entry's category number, as defined by the source.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Category" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The text associated with Category_Num.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Generation_Time" type="cyboxCommon:DateTimeObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Generation_Time field specifies the date/time the event was generated.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Source" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>What logged the event, typically the name of an application or sub-component.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Machine" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The name of the computer on which the event log entry was generated.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="User" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The name of the user (the security ID) responsible for the event.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Blob" type="cyboxCommon:Base64BinaryObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The event data as a binary blob.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Correlation_Activity_ID" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>A globally unique identifier that identifies the current activity.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Correlation_Related_Activity_ID" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>A globally unique identifier that identifies the activity to which control was transferred to.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Execution_Process_ID" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Execution_Process_ID field specifies the Process ID (PID) of the process which created the event.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Execution_Thread_ID" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Execution_Thread_ID field specifies the Thread ID (TID) of the thread which created the event.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Index" type="cyboxCommon:LongObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The index of the event entry in the log.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Reserved" type="cyboxCommon:LongObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>A DWORD value that is always set to ELF_LOG_SIGNATURE (the value 0x654c664c), which is ASCII for eLfL.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Unformatted_Message_List" type="WinEventLogObj:UnformattedMessageListType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>List of unformatted messages in the event log entry.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Write_Time" type="cyboxCommon:DateTimeObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Write_Time field specifies the date/time that the entry was written into the event log.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Complex Type WinEventLogObj:UnformattedMessageListType
Namespace http://cybox.mitre.org/objects#WinEventLogObject-2
Annotations
 
The UnformattedMessageListType type is a list of unformatted messages in the event log entry.
Diagram
Diagram Win_Event_Log_Object_xsd.tmp#UnformattedMessageListType_Unformatted_Message
Used by
Children WinEventLogObj:Unformatted_Message
Source
 
<xs:complexType name="UnformattedMessageListType">
  <xs:annotation>
    <xs:documentation>The UnformattedMessageListType type is a list of unformatted messages in the event log entry.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="Unformatted_Message" type="cyboxCommon:StringObjectPropertyType" minOccurs="1" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>A single unformatted message in the event log entry.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>
XML Schema documentation generated by ® XML Editor.