Detection Event

Access Control Configuration

Access Control Group

Access Control List

Access Mediator

Access Process

Access Token

Activity Dependency

Actuator

Address Space

Administrative Network Traffic

Aircraft Computer

Alias

Allocate Memory

Anonymous Pipe

Application

Application Configuration

Application Configuration Database

Application Configuration Database Record

Application Configuration File

Application Failure Count Variable

Application Installer

Application Inventory Sensor

Application Layer Firewall

Application Layer Link

Application Process

Application Process Configuration

Application Rule

Application Runtime Variable

Application Scan Time

Application Shim

Archive File

Artifact

Artifact Server

Asset Inventory Agent

Asymmetric Key

Atomic Clock

Audio Input Device

Authenticate User

Authentication Function

Authentication Log

Authentication Server

Authentication Service

Authentication Service Application

Authorization Log

Authorization Service

Automotive Electronic Control Unit

Barcode Scanner Input Device

Binary Large Object

Binary Segment

Bitmap Image

Bitmap Image File

Block Device

Boot Loader

Boot ROM

Boot Record

Boot Sector

Browser

Browser Extension

Build Tool

Bus Message

Bus Network

Bus Network Frame

Bus Network Node

Bus Network Traffic

Business Communication Platform Client

CA Certificate File

Processor Cache Memory

Call Stack

Central Processing Unit

Certificate

Certificate File

Certificate Trust Store

Chatroom Client

Child Process

Client Application

Client Computer

Clipboard

Clock

Cloud-based Database Application

Cloud Configuration

Cloud Instance Metadata

Cloud Service Sensor

Cloud Storage

Cloud User Account

Code Analyzer

Code Repository

Codec Application

Codec Library

Collaborative Software

Combination Lock

Command

Command History Log

Command History Log File

Command Line Interface

Compiler

Compiler Configuration File

Computer Cabinet

Computer Case

Computer Enclosure

Computer Network Node

Computer Platform

Computing Image

Computing Server

Computing Snapshot

Configuration Database

Configuration Database Record

Configuration File

Configuration Management Database

Configuration Resource

Connect Socket

Console Output Function

Container Build Tool

Container Image

Container Orchestration Software

Container Process

Container Runtime

Content Policy

Control Flow Graph

Control Flow Policy

Control Server

Copy Memory Function

Copy Token

Create File

Create Process

Create Socket

Create Thread

Credential

Credential Management System

Cryptographic Key

Custom Archive File

Cyber Sensor

DHCP Network Traffic

DHCP Server

DHCP Service

DHCP Service Application

DNS Lookup

DNS Network Traffic

DNS Record

DNS Server

Data Acquisition Agent

Data Acquisition Unit

Data Artifact Server

Data Dependency

Data Link Link

Database

Database Application

Database File

Database Query

Database Record

Database Server

Database Service

Database Service Application

Decoder Application

Decoy Artifact

Default User Account

Delete File

Dependency

Deserialization Function

Desktop Computer

Developer Application

Dial Up Modem

Differential Volume Snapshot

Digital Access Badge

Digital Artifact

Digital Audio

Digital Audio Visual Media

Digital Camera

Digital Document

Digital Event Record

Digital Fingerprint

Digital Identity

Digital Image

Digital Information

Digital Information Bearer

Digital Media

Digital Message

Digital Multimedia

Digital Signal Processing Application

Digital System

Digital Text

Digital Video

Directory

Directory Service

Disk Image

Display Adapter

Display Device Driver

Display Server

Document File

Domain Name

Domain Registration

Domain User Account

Dynamic Analysis Tool

Electrical Signal

Electromagnetic Signal

Electronic Combination Lock

Email Attachment

Email Rule

Embedded Computer

Embedded Database Application

Enclave

Encoder Application

Encrypted Credential

Encrypted Password

Endpoint Sensor

Eval Function

Event Log

Exception Handler

Exec

Executable Binary

Executable File

Executable Script

External Content Inclusion Function

FPGA Bitstream

Fast Symbolic Link

File

File Content Block

File Content Block Data

File Content Block Metadata

File Footer Block

File Footer Block Content

File Footer Block Signature

File Hash

File Header Block

File Header Block Content

File Header Block Signature

File Magic Bytes

File Metadata

File Path Open Function

File Section

File Server

File Share Service

File System

File System Link

File System Metadata

File System Sensor

File Transfer Network Traffic

Finger Print Scanner Input Device

Firewall

Firmware

Firmware Sensor

First-stage Boot Loader

Flash Memory

Flight Software

Forward Proxy Server

Free Memory

Full Volume Snapshot

GNSS Receiver

GNSS Satellite

GNSS Signal

GNSS Time Record

Get Open Sockets

Get Open Windows

Get Running Processes

Get Screen Capture

Get System Config Value

Get System Network Config Value

Get System Time

Get Thread Context

Global User Account

Graphical User Interface

Graphics Card Firmware

Graphics Processing Unit

Group Policy

HMI Application

HMI Application Process

HTML File

Hard Disk Firmware

Hard Link

Hardware Clock

Hardware Clock Device Driver

Hardware Device

Hardware Device Configuration

Hardware Driver

Hardware Timer

Hardware Timer Device Driver

Hardware Watchdog Timer

Heap Segment

Host

Host-based Firewall

Host Configuration Sensor

Host Group

Hostname

Human Input Device Firmware

I/O Module

IP Address

IPC Network Traffic

IP Phone

Identifier

Image Code Segment

Image Data Segment

Image File

Image Scanner Input Device

Image Segment

Impersonate User

Import Library Function

In-memory Password Store

Inbound Internet DNS Response Traffic

Inbound Internet Encrypted Traffic

Inbound Internet Encrypted Web Traffic

Inbound Internet Mail Traffic

Inbound Internet Network Traffic

Inbound Internet Web Traffic

Inbound Network Traffic

Init Script

Input Device

Input Function

Instant Messaging Client

Integration Test Execution Tool

Internet DNS Lookup

Internet File Transfer Traffic

Internet Network

Internet Network Traffic

Internet Persona

Interprocess Communication

Intranet Administrative Network Traffic

Intranet DNS Lookup

Intranet File Transfer Traffic

Intranet IPC Network Traffic

Intranet Multicast Network Traffic

Intranet Network

Intranet Network Traffic

Intranet RPC Network Traffic

Intranet Web Network Traffic

Intrusion Detection System

Intrusion Prevention System

Java Archive

JavaScript Blob

Job Schedule

Job Scheduler Software

Kerberos Ticket

Kerberos Ticket Granting Service Ticket

Kerberos Ticket Granting Ticket

Kerberos Ticket Granting Ticket Account

Kernel

Kernel API Sensor

Kernel Module

Kernel Process Table

Keyboard Input Device

Kiosk Computer

Laptop Computer

Legacy System

Link

Linux Clone

Linux Clone3

Linux Clone3 Argument CLONE_THREAD

Linux Clone Argument CLONE_THREAD

Linux Connect

Linux Creat

Linux Delete Module

Linux Execve

Linux Execveat

Linux Fork

Linux Init_Module

Linux Kill Argument SIGKILL

Linux Mmap

Linux Mmap2

Linux Munmap

Linux Open Argument O_CREAT

Linux Open Argument O_RDONLY, O_WRONLY, O_RDWR

Linux OpenAt2 Argument O_CREAT

Linux OpenAt2 Argument O_RDONLY, O_WRONLY, O_RDWR

Linux OpenAt Argument O_CREAT

Linux OpenAt Argument O_RDONLY, O_WRONLY, O_RDWR

Linux Pause Process

Linux Pause Thread

Linux Ptrace Argument PTRACE_ATTACH

Linux Ptrace Argument PTRACE_CONT

Linux Ptrace Argument PTRACE_GETREGS

Linux Ptrace Argument PTRACE_INTERRUPT

Linux Ptrace Argument PTRACE_PEEKTEXT

Linux Ptrace Argument PTRACE_POKETEXT

Linux Ptrace Argument PTRACE_SETREGS

Linux Ptrace Argument PTRACE_DETACH

Linux Ptrace Argument PTRACE_TRACEME

Linux Read

Linux Readv

Linux Rename

Linux Renameat

Linux Renameat2

Linux Socket

Linux Socketcall Argument SYS_CONNECT

Linux Socketcall Argument SYS_SOCKET

Linux Time

Linux Unlink

Linux Unlinkat

Linux Vfork

Linux Write

Linux Writev

Linux _Exit

Load Module

Local Area Network

Local Area Network Traffic

Local Authentication Service

Local Authorization Service

Local Resource

Local Resource Access

Local User Account

Log

Log File

Log Message Function

Logical Link

Logon User

MAC Address

MacOS Keychain

Mail Network Traffic

Mail Server

Mail Service

Mathematical Function

Media Server

Memory Address

Memory Address Space

Memory Allocation Function

Memory Block

Memory Extent

Memory Free Function

Memory Management Unit

Memory Management Unit Component

Memory Pool

Memory Protection Unit

Memory Word

Message Transfer Agent

Metadata

Microcode

Microsoft HTML Application

Mobile Phone

Modem

Motion Detector

Mouse Input Device

Move File

Multimedia Document File

Multimedia File

NTFS Hard Link

NTFS Junction Point

NTFS Link

NTFS Symbolic Link

Named Pipe

Network

Network Agent

Network Audio Streaming Resource

Network Audio Visual Streaming Resource

Network Card Firmware

Network Directory Resource

Network File Resource

Network File Share Resource

Network Flow

Network Flow Sensor

Network Frame

Network Init Script File Resource

Network Interface Card

Network Link

Network Media Streaming Resource

Network Multimedia Streaming Resource

Network Node

Network Packet

Network Printer

Network Protocol Analyzer

Network Resource

Network Resource Access

Network Scanner

Network Sensor

Network Service Application Process

Network Session

Network Time Server

Network Traffic

Network Traffic Analysis Software

Network Video Streaming Resource

OS API Access Process

OS API Allocate Memory

OS API Connect Socket

OS API Copy Token

OS API Create File

OS API Create Process

OS API Create Socket

OS API Create Thread

OS API Delete File

OS API Exec

OS API Free Memory

OS API Function

OS API Get System Time

OS API Get Thread Context

OS API Load Module

OS API Move File

OS API Open File

OS API Read File

OS API Read Memory

OS API Resume Process

OS API Resume Thread

OS API Save Registers

OS API Set Registers

OS API Set Thread Context

OS API Suspend Process

OS API Suspend Thread

OS API System Function

OS API Terminate Process

OS API Trace Process

OS API Trace Thread

OS API Unload Module

OS API Write File

OS API Write Memory

OT Abort Command

OT Actuator

OT Alarm Message

OT Change Control Program Command

OT Change Data Command

OT Connection Command

OT Control Command

OT Control Function

OT Control Logic Process

OT Control Program

OT Control Variable

OT Controller

OT Controller Operating Mode

OT Create Data Command

OT Create New Control Program Command

OT Debug Command

OT Delete Control Program Command

OT Delete Data Command

OT Device Configuration Command

OT Device Description Message

OT Device Firmware Command

OT Device Identification Message

OT Device Management Message

OT Diagnostics Message

OT Disconnect Remote Connection Command

OT Download Control Program Command

OT Embedded Computer

OT Engineering Software

OT Engineering Workstation

OT Error Message

OT Establish Remote Connection Command

OT Exception Message

OT Human Machine Interface

OT I/O Module

OT Logic Variable

OT Mode Switch

OT Modify Control Program Command

OT Modify Device Configuration Command

OT Modify Device Operating Mode Command

OT Network

OT Network Management Command

OT Network Traffic

OT Pause Command

OT Power Supply

OT Process Data Command

OT Process Data Historian

OT Process Variable

OT Program Mode Command

OT Proprietary Message

OT Protocol Message

OT Read Command

OT Read Device Configuration Command

OT Read File Command

OT Read Time Command

OT Read Value Command

OT Remote Mode Command

OT Run Command

OT Scan Time

OT Security Command

OT Sensor

OT Set Time Command

OT Stop Command

OT Synchronize Time Command

OT Test Command

OT Time Command

OT Transport Configuration Command

OT Watchdog Timer

OT Write Command

Object File

Office Application

Office Application File

Open File

Operating Mode

Operating System

Operating System Clock

Operating System Configuration

Operating System Configuration Component

Operating System Configuration File

Operating System Executable File

Operating System File

Operating System Log File

Operating System Packaging Tool

Operating System Process

Operating System Shared Library File

Operations Center Computer

Optical Disc Image

Optical Modem

Orchestration Controller

Orchestration Server

Orchestration Worker

Outbound Internet DNS Lookup Traffic

Outbound Internet Encrypted Remote Terminal Traffic

Outbound Internet Encrypted Traffic

Outbound Internet Encrypted Web Traffic

Outbound Internet File Transfer Traffic

Outbound Internet Mail Traffic

Outbound Internet Network Traffic

Outbound Internet RPC Traffic

Outbound Internet Web Traffic

Outbound Network Traffic

Output Device

POSIX Symbolic Link

Package URL

Packet Capture File

Packet Log

Page

Page Frame

Page Table

Parent Process

Partition

Partition Table

Password

Password Database

Password File

Password Manager

Password Store

Peripheral Firmware

Peripheral Hub Firmware

Personal Computer

Physical Address

Physical Artifact

Physical Data Diode

Physical Key

Physical Key Lock

Physical Link

Physical Lock

Pipe

Platform Uptime

Pointer

Pointer Dereferencing Function

PowerShell Profile Script

Power Supply

Primary Storage

Print Server

Private Key

Privileged User Account

Process

Process Code Segment

Process Data Segment

Process Environment Variable

Process Image

Process Segment

Process Start Function

Process Tree

Processor

Processor Component

Processor Register

Property List File

Proximity Sensor

Proxy Server

Public Key

Python Package

Python Script File

RAM

RDP Session

ROM

RPC Network Traffic

RTSP Server

Radio Modem

Raw Memory Access Function

Read File

Read Memory

Real-time operating system

Real-time Clock

Receiver

Record

Remote Authentication Service

Remote Authorization Service

Remote Command

Remote Database Query

Remote Login Session

Remote Procedure Call

Remote Resource

Remote Session

Remote Shell Command

Remote Terminal Session

Removable Media Device

Repository

Resource

Resource Access

Resource Fork

Resume Process

Resume Thread

Reverse Proxy Server

Router

Runtime Variable

SSH Session

Safe Mode

Satellite

Satellite Transponder

Save Registers

Saved Instruction Pointer

Scheduled Job

Script Application Process

Second-stage Boot Loader

Secondary Storage

Security Token

Sensor

Serialization Function

Server

Service Account

Service Application

Service Application Process

Service Dependency

Session

Session Cookie

Session Token

Set Registers

Set System Config Value

Set Thread Context

Shadow Stack

Shared Computer

Shared Library File

Shared Resource Access Function

Shell Command

Shim

Shim Database

Shortcut File

Signal

Slow Symbolic Link

Software

Software-defined Radio

Software-Defined Radio Computer

Software-defined Radio Configuration

Software-Defined Radio Device

Software-defined Radio Waveform Application

Software Artifact Server

Software Clock

Software Deployment Tool

Software Library

Software Library File

Software Package

Software Packaging Tool

Software Patch

Software Repository

Software Timer

Software Watchdog Timer

Source Code Analyzer Tool

Spacecraft

Spacecraft Computer

Spacecraft Safe Mode

Stack Component

Stack Frame

Stack Frame Canary

Stack Segment

Startup Directory

Static Analysis Tool

Storage

Storage Image

Storage Snapshot

Stored Procedure

String Format Function

Subroutine

Suspend Process

Suspend Thread

Switch

Symbolic Link

Symmetric Key

System

System Application Cycle Count

System Call

System Config System Call

System Configuration Database

System Configuration Database Record

System Configuration Init Database Record

System Configuration Init Resource

System Dependency

System Firewall Configuration

System Firmware

System Init Configuration

System Init Process

System Init Script

System Password Database

System Platform Variable

System Service Software

System Software

System Startup Directory

System State Image

System Time

System Time Application

System Utilization Record

TFTP Network Traffic

TFTP Server

Tablet Computer

Telecommand

Terminate Process

Tertiary Storage

Test Execution Tool

Thin Client Computer

Thread

Thread Start Function

Ticket Granting Ticket

Time Record

Time Series Database

Timer

Trace Process

Trace Thread

Transceiver

Transducer Sensor

Translation Lookaside Buffer

Transmitter

Transponder

Transport Link

Trust Store

URL

Unit Test Execution Tool

Unix Hard Link

Unix Link

Unload Module

User Account

User Action

User Application

User Behavior

User Group

User Init Configuration File

User Init Script

User Input Function

User Interface

User Logon Init Resource

User Process

User Profile

User Startup Directory

User Startup Script File

User to User Message

Utility Software

Virtual Machine Image

VPN Server

Vector Image

Vector Image File

Vehicle

Vehicle Computer

Vehicle Control Software

Vehicle Operating Mode

Vehicle Software

Version Control Tool

Video Input Device

Virtual Address

Virtual Memory Space

Virtualization Software

Volume

Volume Boot Record

Volume Snapshot

Watchdog Timer

Web API Resource

Web Access Token

Web Application

Web Application Firewall

Web Application Server

Web File Resource

Web Identity Token

Web Network Traffic

Web Resource

Web Resource Access

Web Script File

Web Server

Web Server Application

Wide Area Network

Windows OpenFile

Windows CreateFileA

Windows CreateProcessA

Windows CreateRemoteThread

Windows CreateThread

Windows DeleteFile

Windows DuplicateToken

Windows GetThreadContext

Windows NtGetThreadContext

Windows NtAllocateVirtualMemory

Windows NtAllocateVirtualMemoryEx

Windows NtCreateFile

Windows NtCreateMailslotFile

Windows NtCreateNamedPipeFile

Windows NtCreatePagingFile

Windows NtCreateProcess

Windows NtCreateProcessEx

Windows NtCreateThread

Windows NtCreateThreadEx

Windows NtDeleteFile

Windows NtDuplicateToken

Windows NtFlushInstructionCache

Windows NtFreeVirtualMemory

Windows NtOpenFile

Windows NtOpenProcess

Windows NtOpenThread

Windows NtProtectVirtualMemory

Windows NtQuerySystemTime

Windows NtReadFile

Windows NtReadFileScatter

Windows NtResumeThread

Windows NtSetInformationFile Argument FileDispositionInformation

Windows NtSetThreadContext

Windows NtSuspendProcess

Windows NtSuspendThread

Windows NtTerminateProcess

Windows NtWriteFile

Windows NtWriteFileGather

Windows NtWriteVirtualMemory

Windows OpenProcess

Windows OpenThread

Windows QueryPerformanceCounter

Windows ReadFile

Windows Registry

Windows Registry Key

Windows Registry Value

Windows ResumeThread

Windows SetThreadContext

Windows Shortcut File

Windows SuspendThread

Windows TerminateProcess

Windows VirtualAllocEx

Windows VirtualFree

Windows VirtualProtectEx

Windows WriteFile

Windows WriteProcessMemory

Wired Link

Wireless Access Point

Wireless Link

Wireless Router

Write File

Write Memory

Write Protect Switch

Zero Client Computer

Properties

id: d3f:DetectionEvent

name: Detection Event
definition: An event capturing the identification of a potential security issue, such as unauthorized access attempts, policy violations, or anomalous activities. Detection events form the foundation of cybersecurity monitoring and response.
see also: https://schema.ocsf.io/categories/findings

json

Neighbors

DetectionEvent has no direct neighbors in this release.

Inferred Relationships

This page is experimental and may change significantly in future releases.

Related Countermeasure Techniques

No related defensive techniques in this release.

Related Weaknesses

DetectionEvent has no related weaknesses in this release.

Related Offensive Techniques

No related offensive techniques in this release.