categories.json

{
  "caption": "Categories",
  "name": "category",
  "description": "The OCSF categories organize event classes, each aligned with a specific domain or area of focus.",
  "attributes": {
    "system": {
      "caption": "System Activity",
      "description": "System Activity events.",
      "uid": 1
    },
    "findings": {
      "caption": "Findings",
      "description": "Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.",
      "uid": 2
    },
    "iam": {
      "caption": "Identity & Access Management",
      "description": "Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.",
      "uid": 3
    },
    "network": {
      "caption": "Network Activity",
      "description": "Network Activity events.",
      "uid": 4
    },
    "discovery": {
      "caption": "Discovery",
      "description": "Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.",
      "uid": 5
    },
    "application": {
      "caption": "Application Activity",
      "description": "Application Activity events report detailed information about the behavior of applications and services.",
      "uid": 6
    },
    "remediation": {
      "caption": "Remediation",
      "description": "Remediation events report the results of remediation commands targeting files, processes, and other objects.",
      "uid": 7
    }
  }
}