Associations

[kyle-query]

What does the associations section at the bottom of some pages indicate? For instance, Authentication has

• user: dst_endpoint
• src_endpoint: actor.user
• dst_endpoint: user
• actor.user: src_endpoint

Authorization has

• user: dst_endpoint
• dst_endpoint: user

And all of the System Activity event classes, like File Activity, have:

• device: actor.user
• actor.user device

I've searched this repo and ocsf-server for an explanation, but haven't found anything. I can make some guesses at what these mean in particular circumstances but I'm not really sure how to check if they are correct. Can anyone shed some light?

[rroupski]

@kyle-query sorry for the late response
Currently, the associations are between users and devices (endpoints). An event can have one or more users and one or more endpoints and it could be unclear where a user is defined.

Using the examples above, actor.user is on src_endpoint, and user is on dst_endpoint , in other words actor.user on src_endpoint connects to/logs in on dst_endpoint as user.