Incident Definition Data Model

The Incident Definition data model is a definition that contains all common attributes for any given incident. It extends the Finding definition data model.

The following table details the default attributes of the Incident Definition data model:

Attribute Name	Attribute Type	Relationship Type	Required
`affected`	Text (Multivalued)	N/A	No
`associatedCvesIsCisaExploitable`	Calculated (True False)	N/A	No
`associatedCvesMaximumEpssLikelihood`	Calculated (Number)	N/A	No
`baseRiskScore`	Calculated (Number)	N/A	No
`categories`	Text (Multivalued)	N/A	No
`category`	Text	N/A	No
`complianceStatus`	Calculated (Single Choice)	N/A	No
`connectorCategories`	Text (Multivalued)	N/A	No
`connectorNames`	Text (Multivalued)	N/A	No
`cpeRecords`	Reference (CPE record)	`AFFECTS`	No
`createdBy`	Text	N/A	No
`cveIds`	Text (Multivalued)	N/A	No
`cveRecords`	Reference (CVE record)	`RELATES_TO`	No
`cvssV2AccessComplexity`	Text	N/A	No
`cvssV2AccessVector`	Text	N/A	No
`cvssV2Authentication`	Text	N/A	No
`cvssV2AvailabilityImpact`	Text	N/A	No
`cvssV2BaseScore`	Number	N/A	No
`cvssV2ConfidentialityImpact`	Text	N/A	No
`cvssV2Exploitability`	Text	N/A	No
`cvssV2IntegrityImpact`	Text	N/A	No
`cvssV2RemediationLevel`	Text	N/A	No
`cvssV2ReportConfidence`	Text	N/A	No
`cvssV2Severity`	Text	N/A	No
`cvssV2TemporalScore`	Number	N/A	No
`cvssV2Vector`	Text	N/A	No
`cvssV3AttackComplexity`	Text	N/A	No
`cvssV3AttackVector`	Text	N/A	No
`cvssV3AvailabilityImpact`	Text	N/A	No
`cvssV3BaseScore`	Number	N/A	No
`cvssV3ConfidentialityImpact`	Text	N/A	No
`cvssV3ExploitCodeMaturity`	Text	N/A	No
`cvssV3IntegrityImpact`	Text	N/A	No
`cvssV3PrivilegesRequired`	Text	N/A	No
`cvssV3RemediationLevel`	Text	N/A	No
`cvssV3ReportConfidence`	Text	N/A	No
`cvssV3Severity`	Text	N/A	No
`cvssV3TemporalScore`	Number	N/A	No
`cvssV3UserInteraction`	Text	N/A	No
`cvssV3Vector`	Text	N/A	No
`cweIds`	Text (Multivalued)	N/A	No
`dataIntegrationTitles`	Text (Multivalued)	N/A	No
`dataModelName`	Calculated (Text)	N/A	No
`dateCreated`	Date Time	N/A	No
`daysToFirstDetection`	Calculated (Number)	N/A	No
`description`	Text Area	N/A	No
`displayName`	Calculated (Text)	N/A	Yes
`exploitedInTheWild`	Calculated (True False)	N/A	No
`exploits`	Text (Multivalued)	N/A	No
`exploitsExists`	Calculated (True False)	N/A	No
`findingType`	Category (Finding type)	`IS`	No
`firstdetected`	Calculated (Date Time)	N/A	No
`flowState`	Text	N/A	No
`lastUpdated`	Date Time	N/A	No
`lifecycleInactiveDate`	Date Time	N/A	No
`lifecyclePurgeDate`	Date Time	N/A	No
`lifecycleStatus`	Single Choice	N/A	No
`malware`	Text (Multivalued)	N/A	No
`maximumCveRiskScore`	Calculated (Number)	N/A	No
`name`	Text	N/A	No
`normalizedCweIds`	Calculated (Text, Multivalued)	N/A	Yes
`normalizedAffectedProducts`	Calculated (Text, Multivalued)	N/A	Yes
`numberOutOfCompliance`	Calculated (Number)	N/A	No
`openFindingCount`	Calculated (Number)	N/A	No
`patchAvailable`	True False	N/A	No
`patchPublishedDate`	Date Time	N/A	No
`percentageImpacted`	Calculated (Number)	N/A	No
`profiles`	Category (Finding profile)	`IS`	No
`publishedDate`	Date Time	N/A	No
`recommendation`	Text	N/A	No
`references`	Text (Multivalued)	N/A	No
`riskFactorOffset`	Calculated (Number)	N/A	No
`riskFactors`	Risk Factors	N/A	No
`riskRating`	Calculated (Single Choice)	N/A	No
`riskScore`	Calculated (Number)	N/A	No
`riskScoringModel`	Risk Scoring Model	N/A	No
`severity`	Single Choice	N/A	No
`severityScore`	Number	N/A	No
`source`	Text	N/A	No
`sourceCreatedDate`	Date Time	N/A	No
`sourceLastModified`	Date Time	N/A	No
`sourceStatus`	Text	N/A	No
`sourceUids`	Text (Multivalued)	N/A	No
`sources`	Reference (Source model)	`SOURCED_FROM`	No
`sourcesIcons`	Source data models icons	N/A	No
`summary`	Text	N/A	No
`tags`	Text (Multivalued)	N/A	No
`technologies`	Category (Affected technology)	`IS`	No
`uid`	Text	N/A	Yes
`updatedBy`	Text	N/A	No
`weaknesses`	Reference (Weakness)	`EXPLOITS`	No

FOOTNOTES

The attribute names are used in Brinqa Query Language (BQL) queries and Brinqa Condition Language (BCL) predicates.
In the Type column, Calculated means that the value of the attribute is computed by executing a script. The text in the parentheses after Calculated denotes the type of the outcome. For additional information, see Calculated attributes.
In the Type column, Reference means that two data models are related. The name in the parentheses after Reference indicates the other data model.
The Relationship Type column only applies to the Category and Reference type attributes. You can use the relationship type keyword in BQL queries.