Kernel Object Query [5006] Class
Applicable Profiles: Cloud Container Data Classification Date/Time Host Linux Users macOS Users OSINT Record Integrity Security Control

Discovery Category

Kernel Object Query events report information about discovered kernel resources.
DEPRECATED since v1.5.0
Use the evidence_info class.
Visualizer
Name Caption Group Requirement Type Description
activity_id Activity ID classification Required Integer The normalized identifier of the activity that triggered the event. Each event class defines its own set of activity values. Use 0 (Unknown) when the activity cannot be determined. Use 99 (Other) when the activity does not match any defined value, in which case activity_name must be populated with the source-specific label.
0Unknown
The event activity is unknown.
1Query
The discovered results are via a query request.
99Other
The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.
This is an enum attribute; its string sibling is activity_name.
activity_name Activity classification Optional String The event activity name, as defined by the activity_id. When activity_id is 99 (Other), this attribute must contain the source-specific activity label. For all other activity_id values, this must match the caption defined for that activity_id enum value.
This is the string sibling of enum attribute activity_id.
category_name Category classification Optional String The event category name, as defined by category_uid value: Discovery.
This is the string sibling of enum attribute category_uid.
category_uid Category ID classification Required Integer The category unique identifier of the event. Each event class belongs to exactly one category. Producers and mappers must set this to the category defined by the event class being used.
5Discovery
Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.
This is an enum attribute; its string sibling is category_name.
class_name Class classification Optional String The event class name, as defined by class_uid value: Kernel Object Query.
This is the string sibling of enum attribute class_uid.
class_uid Class ID classification Required Integer The unique identifier of a class. A class describes the attributes available in an event. Producers and mappers must set this to the uid defined in the event class definition. For example, Detection Finding is 2004.
5006Kernel Object Query
Kernel Object Query events report information about discovered kernel resources.
This is an enum attribute; its string sibling is class_name.
count Count occurrence Optional Integer The number of events aggregated into this single record. Only populate for aggregate events. When set, start_time and end_time should also be provided to define the aggregation window.
duration Duration Milliseconds occurrence Optional Long The elapsed time of the aggregation window in milliseconds, from start_time to end_time. Only populate for aggregate events (count > 1). The value should equal end_time - start_time.
end_time End Time occurrence Optional Timestamp The time of the most recent event in an aggregate (count > 1). Do not populate for discrete, point-in-time events - use time alone. Subclasses such as findings may redefine this for their own time-range semantics.
enrichments Enrichments context Optional Enrichment Array The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
kernel Kernel primary Required Kernel Resource The kernel object that pertains to the event.
message Message primary Recommended String A human-readable description of the event, as defined by the source. This should be a concise, meaningful summary suitable for display in a UI or alert notification - not a raw log line. For example: "User john_doe logged in from 10.0.0.1." rather than a raw syslog string.
metadata Metadata context Required Metadata The metadata object describes the event producer, schema version, and processing information. Producers and mappers must populate metadata.product to identify the data source, and metadata.version to indicate the OCSF schema version used. Consumers rely on this to interpret the event correctly.
observables Observables primary Recommended Observable Array The observables array surfaces key indicators and entities from the event or finding in a single, consistent location for downstream correlation and detection. Each entry references an attribute path within the event (e.g., src_endpoint.ip) along with its type and value, enabling consumers to extract IOCs without parsing the full event structure.

Refs:OCSF Observables FAQ
query_info Query Info primary Recommended Query Information The search details associated with the query request.
query_result Query Result primary Recommended String The result of the query.
This is the string sibling of enum attribute query_result_id.
query_result_id Query Result ID primary Required Integer The normalized identifier of the query result.
0Unknown
The query result is unknown.
1Exists
The target was found.
2Partial
The target was partially found.
3Does not exist
The target was not found.
4Error
The discovery attempt failed.
5Unsupported
Discovery of the target was not supported.
99Other
The query result is not mapped. See the query_result attribute, which contains a data source specific value.
This is an enum attribute; its string sibling is query_result.
raw_data Raw Data context Optional String The original event/finding data as received from the source, before normalization into OCSF. Populate this with the verbatim log line, JSON payload, or other native format for forensic and debugging purposes. This field is not intended for structured querying - use the normalized OCSF attributes instead.
raw_data_hash Raw Data Hash O context Optional Fingerprint A fingerprint (hash) of the raw_data content. Use this to verify the integrity of the original event data or to deduplicate events.
raw_data_size Raw Data Size context Optional Long The size of the original event data (as captured in raw_data) in bytes, before OCSF normalization. Useful for metering and capacity planning.
severity Severity classification Optional String The event/finding severity label, normalized to the caption of the severity_id value. When severity_id is 99 (Other), this attribute must contain the source-specific severity label. For all other values, this should match the caption defined for that severity_id enum value (e.g., "High" for severity_id: 4).
This is the string sibling of enum attribute severity_id.
severity_id Severity ID classification Required Integer

The normalized identifier of the event/finding severity.

The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.
0Unknown
The event/finding severity is unknown.
1Informational
Informational message. No action required.
2Low
The user decides if action is needed.
3Medium
Action is required but the situation is not serious at this time.
4High
Action is required immediately.
5Critical
Action is required immediately and the scope is broad.
6Fatal
An error occurred but it is too late to take remedial action.
99Other
The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.
This is an enum attribute; its string sibling is severity.
start_time Start Time occurrence Optional Timestamp The time of the earliest event in an aggregate (count > 1). Do not populate for discrete, point-in-time events - use time alone. Subclasses such as findings may redefine this for their own time-range semantics.
status Status primary Recommended String The event status label, normalized to the caption of the status_id value. When status_id is 99 (Other), this attribute must contain the source-specific status label. For all other values, this must match the caption defined for that status_id enum value (e.g., "Success" for status_id: 1).
This is the string sibling of enum attribute status_id.
status_code Status Code primary Recommended String The source-specific status or error code as reported by the event source. For example, a Windows logon failure code (0x18), an HTTP response code (403), or an AWS API error code. This preserves the original code for detailed troubleshooting beyond what status_id conveys.
status_detail Status Detail primary Recommended String A human-readable description providing additional context about the event outcome. Use this to convey details that go beyond the normalized status_id and source-specific status_code, such as a failure reason or error message. For example: "Account locked after 5 failed attempts.".
status_id Status ID primary Recommended Integer The normalized status of the event outcome. Use this family of attributes to convey the outcome of the activity described by the event. Producers should map their source outcome to 1 (Success) or 2 (Failure). Use 0 (Unknown) when the outcome cannot be determined, and 99 (Other) with a populated status string when the source value does not map cleanly.
0Unknown
The status is unknown.
1Success
The activity completed successfully.
2Failure
The activity failed.
99Other
The status is not mapped. See the status attribute, which contains a data source specific value.
This is an enum attribute; its string sibling is status.
time Event Time occurrence Required Timestamp The primary timestamp of the event - when the activity actually occurred at the source. This does not capture when the event record was created or serialized by the source system; for event lifecycle timestamps such as ingestion and processing, use metadata.logged_time and metadata.processed_time respectively, or the equivalent attributes in the metadata.loggers array when recording pipeline stages. For aggregate events (count > 1), set this to start_time (the earliest OCSF time in the aggregate) to preserve causal ordering and consistent timeline alignment. Note: finding classes redefine time as the finding creation time rather than the activity occurrence time. This must be a UTC epoch value in milliseconds (e.g., 1776881335332). Mappers should use the most precise and authoritative timestamp available from the source.
timezone_offset Timezone Offset occurrence Recommended Integer The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080. This allows consumers to reconstruct the local time at the event source. For example, US Eastern Standard Time is -300. Populate this when the source provides local time zone information.
type_name Type Name classification Optional String The event/finding type name, combining the class and activity (e.g., "Detection Finding: Create"). The value must match the class_name and activity_name joined by ": ".
This is the string sibling of enum attribute type_uid.
type_uid Type ID classification Required Long The event/finding type ID. It identifies the event's semantics and structure. Producers and mappers must compute this as class_uid * 100 + activity_id. It uniquely identifies the combination of event class and activity across the entire schema. For example, Detection Finding: Create is 200401.
500600Kernel Object Query: Unknown
500601Kernel Object Query: Query
The discovered results are via a query request.
500699Kernel Object Query: Other
This is an enum attribute; its string sibling is type_name.
unmapped Unmapped Data context Optional Object A container for source-specific attributes that do not map to any defined OCSF attribute. Use this to preserve valuable source data that would otherwise be lost during normalization. The keys and values are specific to the event source.

Note: Consumers should not rely on a stable structure within this field. The preferred approach to unmapped attributes is to create a custom extension with the desired structure.

Refs:Schema FAQ: When should I use the unmapped attribute? OCSF Extensions