Detection Event
Access
Access Control Administration Event
Access Control Event
Access Denied Event
Access Granted Event
Access Mediation Event
Action
Add User to Group Event
Application Configuration Modification Event
Application Deletion Event
Application Disable Event
Application Enable Event
Application Event
Application Installation Event
Application Layer Event
Application Restart Event
Application Start Event
Application Stop Event
Application Update Event
Assign Privileges to Group Event
Authentication
Authentication Event
Authorization
Authorization Event
Clock Event
Clock Synchronization Event
Cloud Configuration Modification Event
Cloud Service Authentication
Cloud Service Authorization
Compute Device Event
Configuration Event
Configuration Modification Event
Cyber Action
DHCP Ack Event
DHCP Discover Event
DHCP Event
DHCP Inform Event
DHCP Lease Expire Event
DHCP Nak Event
DHCP Offer Event
DHCP Release Event
DHCP Request Event
DNS Event
DNS Query Event
DNS Response Event
Defensive Action
Detection Event
Digital Event
Electronic Combination Lock Event
Email Event
Email Receive Event
Email Scan Event
Email Send Event
Event
Event Log Archive Event
Event Log Clear Event
Event Log Delete Event
Event Log Disable Event
Event Log Enable Event
Event Log Event
Event Log Export Event
Event Log Restart Event
Event Log Rotate Event
Event Log Start Event
Event Log Stop Event
Eviction Event
FTP Delete Event
FTP Event
FTP Get Event
FTP List Event
FTP Poll Event
FTP Put Event
FTP Rename Event
File Access Event
File Copy Event
File Creation Event
File Decryption Event
File Deletion Event
File Encryption Event
File Event
File Get Attributes Event
File Get Permissions Event
File Mount Event
File Renaming Event
File Set Attributes Event
File Set Permissions Event
File Unmount Event
File Update Event
Group Creation Event
Group Deletion Event
Group Management Event
HTTP CONNECT Event
HTTP DELETE Event
HTTP Event
HTTP GET Event
HTTP HEAD Event
HTTP OPTIONS Event
HTTP POST Event
HTTP PUT Event
HTTP Request Event
HTTP Response Event
HTTP TRACE Event
Hardening Event
Hardware Clock Event
Hardware Device Bind Event
Hardware Device Connection Event
Hardware Device Disabled Event
Hardware Device Disconnection Event
Hardware Device Enabled Event
Hardware Device Event
Hardware Device Move Event
Hardware Device State Event
Hardware Device Unbind Event
Hardware Device Update Event
Hardware Timer Configuration Event
Hardware Timer Event
Hardware Timer Interrupt Event
Input Device Event
Isolation Event
Kernel Event
Kernel Module Event
Kernel Module Load Event
Kernel Module Unload Event
Load Library Event
Logoff Event
Logon Event
Memory Allocation Event
Memory Deletion Event
Memory Device Event
Memory Event
Memory Map Event
Memory Modification Event
Memory Read Event
Memory Write Event
Motion Detected Event
NTP Broadcast Event
NTP Client Synchronization Event
NTP Control Message Event
NTP Event
NTP Server Response Event
NTP Symmetric Active Exchange Event
NTP Symmetric Passive Exchange Event
Network Connection Close Event
Network Connection Event
Network Connection Fail Event
Network Connection Listen Event
Network Connection Open Event
Network Connection Refuse Event
Network Connection Reset Event
Network Device Event
Network Event
OT Abort Command Event
OT Alarm Message Event
OT Change Control Program Command Event
OT Change Data Command Event
OT Connection Command Event
OT Control Command Event
OT Create Data Command Event
OT Create New Control Program Command Event
OT Debug Command Event
OT Delete Control Program Command Event
OT Delete Data Command Event
OT Device Configuration Command Event
OT Device Description Message Event
OT Device Firmware Command Event
OT Device Identification Message Event
OT Device Management Message Event
OT Diagnostics Message Event
OT Disconnect Remote Connection Command Event
OT Download Control Program Command Event
OT Error Message Event
OT Establish Remote Connection Command Event
OT Event
OT Exception Message Event
OT Modify Control Program Command Event
OT Modify Device Configuration Command Event
OT Modify Device Operating Mode Command Event
OT Network Management Command Event
OT Pause Command Event
OT Process Data Command Event
OT Program Mode Command Event
OT Proprietary Message Event
OT Read Command Event
OT Read Device Configuration Command Event
OT Read File Command Event
OT Read Time Command Event
OT Read Value Command Event
OT Remote Mode Command Event
OT Run Command Event
OT Security Command Event
OT Set Time Command Event
OT Stop Command Event
OT Synchronize Time Command Event
OT Test Command Event
OT Time Command Event
OT Transport Configuration Command Event
OT Write Command Event
Offensive Action
Operating System Configuration Modification Event
Operational Event
Output Device Event
Peripheral Device Event
Permission Granting Event
Permission Revoking Event
Physical Access Alarm Event
Physical Link Connect Event
Physical Link Disable Event
Physical Link Disconnect Event
Physical Link Down Event
Physical Link Error Disable Event
Physical Link Event
Physical Link Up Event
Power and Thermal Device Event
Pre-Authentication Event
Process Access Event
Process Creation Event
Process Event
Process Set User ID Event
Process Termination Event
Proximity Sensor Event
RDP Connect Request Event
RDP Connect Response Event
RDP Event
RDP Initial Request Event
RDP Initial Response Event
RDP TLS Handshake Event
RTC Update Event
Remove User from Group Event
Restoration Event
Revoke Privileges from Group Event
SMB Event
SMB File Create Event
SMB File Open Event
SMB File Open If Event
SMB File Overwrite Event
SMB File Overwrite If Event
SMB File Supersede Event
SSH Connection Close Event
SSH Connection Fail Event
SSH Connection Open Event
SSH Connection Refuse Event
SSH Connection Reset Event
SSH Event
SSH Listen Event
Scheduled Job Creation Event
Scheduled Job Deletion Event
Scheduled Job Disable Event
Scheduled Job Enable Event
Scheduled Job Event
Scheduled Job Start Event
Scheduled Job Update Event
Security Event
Service Deletion Event
Service Disable Event
Service Enable Event
Service Event
Service Installation Event
Service Restart Event
Service Start Event
Service Stop Event
Service Update Event
Software-defined Radio Event
Software-defined Radio RF State Change Event
Software-defined Radio Waveform Application Configuration Event
Software-defined Radio Waveform Application Load Event
Software Clock Event
Software Timer Event
Storage Device Event
System Call Event
System Clock Update Event
TCP Event
Timer Event
Timer Expiration Event
Timer Modification Event
Timer Set Event
Transport Layer Event
Tunnel Close Event
Tunnel Event
Tunnel Open Event
Tunnel Renew Event
UDP Event
Unload Library Event
User Account Attach Policy Event
User Account Creation Event
User Account Deletion Event
User Account Detach Policy Event
User Account Disable Event
User Account Enable Event
User Account Event
User Account Lock Event
User Account MFA Disable Event
User Account MFA Enable Event
User Account Password Change Event
User Account Password Reset Event
User Account Update Event
Watchdog Timer Configuration Event
Watchdog Timer Event
Watchdog Timer Expiration Event
Watchdog Timer Reset Event
Watchdog Timer Service Event
Web Authentication
Windows Registry Event
Windows Registry Key Creation Event
Windows Registry Key Deletion Event
Windows Registry Key Event
Windows Registry Key Export Event
Windows Registry Key Import Event
Windows Registry Key Read Event
Windows Registry Key Renaming Event
Windows Registry Key Restore Event
Windows Registry Key Set Security Event
Windows Registry Key Update Event
Windows Registry Value Deletion Event
Windows Registry Value Event
Windows Registry Value Get Event
Windows Registry Value Set Event
Windows Registry Value Update Event
Properties
- name
- Detection Event
- definition
- An event capturing the identification of a potential security issue, such as unauthorized access attempts, policy violations, or anomalous activities. Detection events form the foundation of cybersecurity monitoring and response.
- see also
- https://schema.ocsf.io/categories/findings