Alert Definition Data Model
The Alert Definition data model is a definition that contains all common attributes for any given alert. It extends the Finding definition data model.
The following table details the default attributes of the Alert Definition data model:
| Attribute Name | Attribute Type | Relationship Type | Required |
|---|---|---|---|
affected | Text (Multivalued) | N/A | No |
associatedCvesIsCisaExploitable | True False | N/A | No |
associatedCvesMaximumEpssLikelihood | Number | N/A | No |
baseRiskScore | Calculated (Number) | N/A | No |
categories | Text (Multivalued) | N/A | No |
category | Text | N/A | No |
complianceStatus | Calculated (Single Choice) | N/A | No |
connectorCategories | Text (Multivalued) | N/A | No |
connectorNames | Text (Multivalued) | N/A | No |
cpeRecords | Reference (CPE record) | AFFECTS | No |
createdBy | Text | N/A | No |
cveIds | Text (Multivalued) | N/A | No |
cveRecords | Reference (CVE record) | RELATES_TO | No |
cvssV2AccessComplexity | Text | N/A | No |
cvssV2AccessVector | Text | N/A | No |
cvssV2Authentication | Text | N/A | No |
cvssV2AvailabilityImpact | Text | N/A | No |
cvssV2BaseScore | Number | N/A | No |
cvssV2ConfidentialityImpact | Text | N/A | No |
cvssV2Exploitability | Text | N/A | No |
cvssV2IntegrityImpact | Text | N/A | No |
cvssV2RemediationLevel | Text | N/A | No |
cvssV2ReportConfidence | Text | N/A | No |
cvssV2Severity | Text | N/A | No |
cvssV2TemporalScore | Number | N/A | No |
cvssV2Vector | Text | N/A | No |
cvssV3AttackComplexity | Text | N/A | No |
cvssV3AttackVector | Text | N/A | No |
cvssV3AvailabilityImpact | Text | N/A | No |
cvssV3BaseScore | Number | N/A | No |
cvssV3ConfidentialityImpact | Text | N/A | No |
cvssV3ExploitCodeMaturity | Text | N/A | No |
cvssV3IntegrityImpact | Text | N/A | No |
cvssV3PrivilegesRequired | Text | N/A | No |
cvssV3RemediationLevel | Text | N/A | No |
cvssV3ReportConfidence | Text | N/A | No |
cvssV3Severity | Text | N/A | No |
cvssV3TemporalScore | Number | N/A | No |
cvssV3UserInteraction | Text | N/A | No |
cvssV3Vector | Text | N/A | No |
cweIds | Text (Multivalued) | N/A | No |
dataIntegrationTitles | Text (Multivalued) | N/A | No |
dataModelName | Calculated (Text) | N/A | No |
dateCreated | Date Time | N/A | No |
daysToFirstDetection | Calculated (Number) | N/A | No |
description | Text Area | N/A | No |
displayName | Calculated (Text) | N/A | Yes |
exploitedInTheWild | Calculated (True False) | N/A | No |
exploits | Text (Multivalued) | N/A | No |
exploitsExists | Calculated (True False) | N/A | No |
findingType | Category (Finding type) | IS | No |
firstdetected | Calculated (Date Time) | N/A | No |
flowState | Text | N/A | No |
lastUpdated | Date Time | N/A | No |
lifecycleInactiveDate | Date Time | N/A | No |
lifecyclePurgeDate | Date Time | N/A | No |
lifecycleStatus | Single Choice | N/A | No |
malware | Text (Multivalued) | N/A | No |
maximumCveRiskScore | Number | N/A | No |
name | Text | N/A | No |
normalizedCweIds | Calculated (Text, Multivalued) | N/A | Yes |
normalizedAffectedProducts | Calculated (Text, Multivalued) | N/A | Yes |
numberOutOfCompliance | Calculated (Number) | N/A | No |
openFindingCount | Calculated (Number) | N/A | No |
patchAvailable | True False | N/A | No |
patchPublishedDate | Date Time | N/A | No |
percentageImpacted | Calculated (Number) | N/A | No |
profiles | Category (Finding profile) | IS | No |
publishedDate | Date Time | N/A | No |
recommendation | Text | N/A | No |
references | Text (Multivalued) | N/A | No |
riskFactorOffset | Calculated (Number) | N/A | No |
riskFactors | Risk Factors | N/A | No |
riskRating | Calculated (Single Choice) | N/A | No |
riskScore | Calculated (Number) | N/A | No |
riskScoringModel | Risk Scoring Model | N/A | No |
severity | Single Choice | N/A | No |
severityScore | Number | N/A | No |
source | Text | N/A | No |
sourceCreatedDate | Date Time | N/A | No |
sourceLastModified | Date Time | N/A | No |
sourceStatus | Text | N/A | No |
sourceUids | Text (Multivalued) | N/A | No |
sources | Reference (Source model) | SOURCED_FROM | No |
sourcesIcons | Source data models icons | N/A | No |
summary | Text | N/A | No |
tags | Text (Multivalued) | N/A | No |
technologies | Category (Affected technology) | IS | No |
uid | Text | N/A | Yes |
updatedBy | Text | N/A | No |
weaknesses | Reference (Weakness) | EXPLOITS | No |
FOOTNOTES
- The attribute names are used in Brinqa Query Language (BQL) queries and Brinqa Condition Language (BCL) predicates.
- In the Type column, Calculated means that the value of the attribute is computed by executing a script. The text in the parentheses after Calculated denotes the type of the outcome. For additional information, see Calculated attributes.
- In the Type column, Reference means that two data models are related. The name in the parentheses after Reference indicates the other data model.
- The Relationship Type column only applies to the Category and Reference type attributes. You can use the relationship type keyword in BQL queries.