syntax = "proto3";

package ocsf.v1_0_0.events.system;

option go_package = "/ocsf/v1_0_0/events/system";

option java_package = "com.your.project.generated.ocsf.v1_0_0.events.system";

option java_multiple_files = true;

import "ocsf/v1_0_0/objects/objects.proto";

import "ocsf/v1_0_0/events/system/enums/enums.proto";

// Event UID: 2
// URL: https://schema.ocsf.io/1.0.0/classes/kernel_extension
// Event: system
message KernelExtension {
	repeated ocsf.v1_0_0.objects.Malware malware = 1; // Caption: Malware; Profile: security_control;
	string status = 2; // Caption: Status;
	ocsf.v1_0_0.objects.Metadata metadata = 3; // Caption: Metadata;
	ocsf.v1_0_0.events.system.enums.KERNEL_EXTENSION_ACTIVITY_ID activity_id = 4; // Caption: Activity ID;
	int64 time = 5; // Caption: Event Time;
	string severity = 6; // Caption: Severity;
	int32 count = 7; // Caption: Count;
	ocsf.v1_0_0.events.system.enums.KERNEL_EXTENSION_CLASS_UID class_uid = 8; // Caption: Class ID;
	int32 timezone_offset = 9; // Caption: Timezone Offset;
	int32 duration = 10; // Caption: Duration;
	string class_name = 11; // Caption: Class;
	ocsf.v1_0_0.objects.Api api = 12; // Caption: API Details; Profile: cloud;
	string disposition = 13; // Caption: Disposition; Profile: security_control;
	string message = 14; // Caption: Message;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 15; // Caption: Enrichments;
	string activity_name = 16; // Caption: Activity;
	string raw_data = 17; // Caption: Raw Data;
	string status_code = 18; // Caption: Status Code;
	ocsf.v1_0_0.events.system.enums.KERNEL_EXTENSION_STATUS_ID status_id = 19; // Caption: Status ID;
	ocsf.v1_0_0.events.system.enums.KERNEL_EXTENSION_TYPE_UID type_uid = 20; // Caption: Type ID;
	repeated ocsf.v1_0_0.objects.Observable observables = 21; // Caption: Observables;
	ocsf.v1_0_0.objects.Device device = 22; // Caption: Device;
	ocsf.v1_0_0.objects.Object unmapped = 23; // Caption: Unmapped Data;
	ocsf.v1_0_0.events.system.enums.KERNEL_EXTENSION_DISPOSITION_ID disposition_id = 24; // Profile: security_control; Caption: Disposition ID;
	repeated ocsf.v1_0_0.objects.Attack attacks = 25; // Caption: Attacks; Profile: security_control;
	ocsf.v1_0_0.objects.Actor actor = 26; // Caption: Actor;
	int64 end_time = 27; // Caption: End Time;
	ocsf.v1_0_0.events.system.enums.KERNEL_EXTENSION_CATEGORY_UID category_uid = 28; // Caption: Category ID;
	ocsf.v1_0_0.events.system.enums.KERNEL_EXTENSION_SEVERITY_ID severity_id = 29; // Caption: Severity ID;
	int64 start_time = 30; // Caption: Start Time;
	ocsf.v1_0_0.objects.KernelDriver driver = 31; // Caption: Kernel Driver;
	string category_name = 32; // Caption: Category;
	string type_name = 33; // Caption: Type Name;
	string status_detail = 34; // Caption: Status Details;
	ocsf.v1_0_0.objects.Cloud cloud = 35; // Caption: Cloud; Profile: cloud;
}

// Event: system
// Event UID: 1
// URL: https://schema.ocsf.io/1.0.0/classes/file_activity
message FileActivity {
	ocsf.v1_0_0.events.system.enums.FILE_ACTIVITY_CLASS_UID class_uid = 1; // Caption: Class ID;
	int32 timezone_offset = 2; // Caption: Timezone Offset;
	ocsf.v1_0_0.objects.File file_result = 3; // Caption: File Result;
	string file_diff = 4; // Caption: File Diff;
	string status_detail = 5; // Caption: Status Details;
	string class_name = 6; // Caption: Class;
	ocsf.v1_0_0.objects.Actor actor = 7; // Caption: Actor;
	string create_mask = 8; // Caption: Create Mask;
	ocsf.v1_0_0.objects.Metadata metadata = 9; // Caption: Metadata;
	repeated ocsf.v1_0_0.objects.Malware malware = 10; // Caption: Malware; Profile: security_control;
	repeated ocsf.v1_0_0.objects.Observable observables = 11; // Caption: Observables;
	string status_code = 12; // Caption: Status Code;
	int64 start_time = 13; // Caption: Start Time;
	repeated ocsf.v1_0_0.objects.Attack attacks = 14; // Caption: Attacks; Profile: security_control;
	int32 access_mask = 15; // Caption: Access Mask;
	string connection_uid = 16; // Caption: Connection Identifier;
	ocsf.v1_0_0.objects.File file = 17; // Caption: File;
	string activity_name = 18; // Caption: Activity;
	string raw_data = 19; // Caption: Raw Data;
	string category_name = 20; // Caption: Category;
	ocsf.v1_0_0.events.system.enums.FILE_ACTIVITY_ACTIVITY_ID activity_id = 21; // Caption: Activity ID;
	string component = 22; // Caption: Component;
	string disposition = 23; // Caption: Disposition; Profile: security_control;
	string type_name = 24; // Caption: Type Name;
	ocsf.v1_0_0.events.system.enums.FILE_ACTIVITY_CATEGORY_UID category_uid = 25; // Caption: Category ID;
	string severity = 26; // Caption: Severity;
	int64 time = 27; // Caption: Event Time;
	ocsf.v1_0_0.events.system.enums.FILE_ACTIVITY_DISPOSITION_ID disposition_id = 28; // Caption: Disposition ID; Profile: security_control;
	string status = 29; // Caption: Status;
	int32 duration = 30; // Caption: Duration;
	ocsf.v1_0_0.objects.Device device = 31; // Caption: Device;
	ocsf.v1_0_0.objects.Api api = 32; // Caption: API Details; Profile: cloud;
	ocsf.v1_0_0.events.system.enums.FILE_ACTIVITY_SEVERITY_ID severity_id = 33; // Caption: Severity ID;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 34; // Caption: Enrichments;
	int32 count = 35; // Caption: Count;
	string message = 36; // Caption: Message;
	int64 end_time = 37; // Caption: End Time;
	ocsf.v1_0_0.events.system.enums.FILE_ACTIVITY_STATUS_ID status_id = 38; // Caption: Status ID;
	ocsf.v1_0_0.events.system.enums.FILE_ACTIVITY_TYPE_UID type_uid = 39; // Caption: Type ID;
	ocsf.v1_0_0.objects.Cloud cloud = 40; // Caption: Cloud; Profile: cloud;
	ocsf.v1_0_0.objects.Object unmapped = 41; // Caption: Unmapped Data;
}

// Event: system
// Event UID: 1
// URL: https://schema.ocsf.io/1.0.0/classes/registry_key_activity
message RegistryKeyActivity {
	int32 open_mask = 1; // Caption: Open Mask;
	ocsf.v1_0_0.events.system.enums.REGISTRY_KEY_ACTIVITY_CLASS_UID class_uid = 2; // Caption: Class ID;
	ocsf.v1_0_0.objects.Device device = 3; // Caption: Device;
	ocsf.v1_0_0.events.system.enums.REGISTRY_KEY_ACTIVITY_CATEGORY_UID category_uid = 4; // Caption: Category ID;
	string disposition = 5; // Caption: Disposition; Profile: security_control;
	repeated ocsf.v1_0_0.objects.Malware malware = 6; // Caption: Malware; Profile: security_control;
	ocsf.v1_0_0.events.system.enums.REGISTRY_KEY_ACTIVITY_SEVERITY_ID severity_id = 7; // Caption: Severity ID;
	int32 access_mask = 8; // Caption: Access Mask;
	int32 timezone_offset = 9; // Caption: Timezone Offset;
	string activity_name = 10; // Caption: Activity;
	int32 duration = 11; // Caption: Duration;
	string type_name = 12; // Caption: Type Name;
	ocsf.v1_0_0.objects.Api api = 13; // Caption: API Details; Profile: cloud;
	int64 start_time = 14; // Caption: Start Time;
	ocsf.v1_0_0.objects.Cloud cloud = 15; // Caption: Cloud; Profile: cloud;
	string message = 16; // Caption: Message;
	ocsf.v1_0_0.objects.Actor actor = 17; // Caption: Actor;
	repeated ocsf.v1_0_0.objects.Attack attacks = 18; // Caption: Attacks; Profile: security_control;
	int32 count = 19; // Caption: Count;
	string class_name = 20; // Caption: Class;
	string raw_data = 21; // Caption: Raw Data;
	ocsf.v1_0_0.events.system.enums.REGISTRY_KEY_ACTIVITY_STATUS_ID status_id = 22; // Caption: Status ID;
	ocsf.v1_0_0.events.system.enums.REGISTRY_KEY_ACTIVITY_TYPE_UID type_uid = 23; // Caption: Type ID;
	ocsf.v1_0_0.objects.RegistryKey reg_key = 24; // Caption: Registry Key;
	ocsf.v1_0_0.events.system.enums.REGISTRY_KEY_ACTIVITY_DISPOSITION_ID disposition_id = 25; // Caption: Disposition ID; Profile: security_control;
	ocsf.v1_0_0.objects.Metadata metadata = 26; // Caption: Metadata;
	string status = 27; // Caption: Status;
	repeated ocsf.v1_0_0.objects.Observable observables = 28; // Caption: Observables;
	string severity = 29; // Caption: Severity;
	string category_name = 30; // Caption: Category;
	ocsf.v1_0_0.objects.RegistryKey prev_reg_key = 31; // Caption: Previous Registry Key;
	ocsf.v1_0_0.objects.Object unmapped = 32; // Caption: Unmapped Data;
	int64 time = 33; // Caption: Event Time;
	int64 end_time = 34; // Caption: End Time;
	string status_detail = 35; // Caption: Status Details;
	string create_mask = 36; // Caption: Create Mask;
	ocsf.v1_0_0.events.system.enums.REGISTRY_KEY_ACTIVITY_ACTIVITY_ID activity_id = 37; // Caption: Activity ID;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 38; // Caption: Enrichments;
	string status_code = 39; // Caption: Status Code;
}

// Event: system
// Event UID: 6
// URL: https://schema.ocsf.io/1.0.0/classes/scheduled_job_activity
message ScheduledJobActivity {
	string status = 1; // Caption: Status;
	string activity_name = 2; // Caption: Activity;
	string type_name = 3; // Caption: Type Name;
	ocsf.v1_0_0.events.system.enums.SCHEDULED_JOB_ACTIVITY_DISPOSITION_ID disposition_id = 4; // Caption: Disposition ID; Profile: security_control;
	string status_detail = 5; // Caption: Status Details;
	int64 time = 6; // Caption: Event Time;
	int64 end_time = 7; // Caption: End Time;
	string raw_data = 8; // Caption: Raw Data;
	ocsf.v1_0_0.events.system.enums.SCHEDULED_JOB_ACTIVITY_TYPE_UID type_uid = 9; // Caption: Type ID;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 10; // Caption: Enrichments;
	string severity = 11; // Caption: Severity;
	string message = 12; // Caption: Message;
	string class_name = 13; // Caption: Class;
	ocsf.v1_0_0.objects.Job job = 14; // Caption: Job;
	ocsf.v1_0_0.events.system.enums.SCHEDULED_JOB_ACTIVITY_SEVERITY_ID severity_id = 15; // Caption: Severity ID;
	ocsf.v1_0_0.objects.Cloud cloud = 16; // Caption: Cloud; Profile: cloud;
	ocsf.v1_0_0.events.system.enums.SCHEDULED_JOB_ACTIVITY_CLASS_UID class_uid = 17; // Caption: Class ID;
	int64 start_time = 18; // Caption: Start Time;
	ocsf.v1_0_0.objects.Metadata metadata = 19; // Caption: Metadata;
	repeated ocsf.v1_0_0.objects.Observable observables = 20; // Caption: Observables;
	int32 duration = 21; // Caption: Duration;
	ocsf.v1_0_0.objects.Device device = 22; // Caption: Device;
	string category_name = 23; // Caption: Category;
	int32 timezone_offset = 24; // Caption: Timezone Offset;
	repeated ocsf.v1_0_0.objects.Attack attacks = 25; // Caption: Attacks; Profile: security_control;
	ocsf.v1_0_0.events.system.enums.SCHEDULED_JOB_ACTIVITY_STATUS_ID status_id = 26; // Caption: Status ID;
	ocsf.v1_0_0.objects.Object unmapped = 27; // Caption: Unmapped Data;
	ocsf.v1_0_0.events.system.enums.SCHEDULED_JOB_ACTIVITY_ACTIVITY_ID activity_id = 28; // Caption: Activity ID;
	repeated ocsf.v1_0_0.objects.Malware malware = 29; // Caption: Malware; Profile: security_control;
	string disposition = 30; // Profile: security_control; Caption: Disposition;
	string status_code = 31; // Caption: Status Code;
	ocsf.v1_0_0.objects.Api api = 32; // Caption: API Details; Profile: cloud;
	ocsf.v1_0_0.events.system.enums.SCHEDULED_JOB_ACTIVITY_CATEGORY_UID category_uid = 33; // Caption: Category ID;
	int32 count = 34; // Caption: Count;
	ocsf.v1_0_0.objects.Actor actor = 35; // Caption: Actor;
}

// Event: system
// Event UID: 3
// URL: https://schema.ocsf.io/1.0.0/classes/kernel_activity
message KernelActivity {
	ocsf.v1_0_0.events.system.enums.KERNEL_ACTIVITY_CLASS_UID class_uid = 1; // Caption: Class ID;
	string severity = 2; // Caption: Severity;
	string message = 3; // Caption: Message;
	int32 duration = 4; // Caption: Duration;
	repeated ocsf.v1_0_0.objects.Malware malware = 5; // Caption: Malware; Profile: security_control;
	string status_detail = 6; // Caption: Status Details;
	int32 timezone_offset = 7; // Caption: Timezone Offset;
	string status = 8; // Caption: Status;
	ocsf.v1_0_0.events.system.enums.KERNEL_ACTIVITY_TYPE_UID type_uid = 9; // Caption: Type ID;
	int64 end_time = 10; // Caption: End Time;
	int32 count = 11; // Caption: Count;
	ocsf.v1_0_0.objects.Kernel kernel = 12; // Caption: Kernel;
	ocsf.v1_0_0.objects.Cloud cloud = 13; // Caption: Cloud; Profile: cloud;
	ocsf.v1_0_0.objects.Actor actor = 14; // Caption: Actor;
	string raw_data = 15; // Caption: Raw Data;
	ocsf.v1_0_0.events.system.enums.KERNEL_ACTIVITY_STATUS_ID status_id = 16; // Caption: Status ID;
	string status_code = 17; // Caption: Status Code;
	ocsf.v1_0_0.events.system.enums.KERNEL_ACTIVITY_ACTIVITY_ID activity_id = 18; // Caption: Activity ID;
	ocsf.v1_0_0.events.system.enums.KERNEL_ACTIVITY_CATEGORY_UID category_uid = 19; // Caption: Category ID;
	ocsf.v1_0_0.events.system.enums.KERNEL_ACTIVITY_DISPOSITION_ID disposition_id = 20; // Caption: Disposition ID; Profile: security_control;
	int64 start_time = 21; // Caption: Start Time;
	ocsf.v1_0_0.objects.Object unmapped = 22; // Caption: Unmapped Data;
	ocsf.v1_0_0.objects.Device device = 23; // Caption: Device;
	ocsf.v1_0_0.objects.Api api = 24; // Caption: API Details; Profile: cloud;
	repeated ocsf.v1_0_0.objects.Observable observables = 25; // Caption: Observables;
	string class_name = 26; // Caption: Class;
	string type_name = 27; // Caption: Type Name;
	repeated ocsf.v1_0_0.objects.Attack attacks = 28; // Caption: Attacks; Profile: security_control;
	string disposition = 29; // Caption: Disposition; Profile: security_control;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 30; // Caption: Enrichments;
	string category_name = 31; // Caption: Category;
	ocsf.v1_0_0.events.system.enums.KERNEL_ACTIVITY_SEVERITY_ID severity_id = 32; // Caption: Severity ID;
	string activity_name = 33; // Caption: Activity;
	int64 time = 34; // Caption: Event Time;
	ocsf.v1_0_0.objects.Metadata metadata = 35; // Caption: Metadata;
}

// Event: system
// Event UID: 4
// URL: https://schema.ocsf.io/1.0.0/classes/memory_activity
message MemoryActivity {
	repeated ocsf.v1_0_0.objects.Malware malware = 1; // Caption: Malware; Profile: security_control;
	string disposition = 2; // Caption: Disposition; Profile: security_control;
	string message = 3; // Caption: Message;
	int32 timezone_offset = 4; // Caption: Timezone Offset;
	int64 time = 5; // Caption: Event Time;
	int32 count = 6; // Caption: Count;
	string status_code = 7; // Caption: Status Code;
	string status_detail = 8; // Caption: Status Details;
	ocsf.v1_0_0.events.system.enums.MEMORY_ACTIVITY_CATEGORY_UID category_uid = 9; // Caption: Category ID;
	ocsf.v1_0_0.events.system.enums.MEMORY_ACTIVITY_SEVERITY_ID severity_id = 10; // Caption: Severity ID;
	ocsf.v1_0_0.objects.Cloud cloud = 11; // Caption: Cloud; Profile: cloud;
	repeated ocsf.v1_0_0.objects.Attack attacks = 12; // Caption: Attacks; Profile: security_control;
	int32 requested_permissions = 13; // Caption: Requested Permissions;
	int64 size = 14; // Caption: Size;
	ocsf.v1_0_0.objects.Object unmapped = 15; // Caption: Unmapped Data;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 16; // Caption: Enrichments;
	ocsf.v1_0_0.objects.Metadata metadata = 17; // Caption: Metadata;
	string type_name = 18; // Caption: Type Name;
	ocsf.v1_0_0.events.system.enums.MEMORY_ACTIVITY_TYPE_UID type_uid = 19; // Caption: Type ID;
	int64 start_time = 20; // Caption: Start Time;
	ocsf.v1_0_0.events.system.enums.MEMORY_ACTIVITY_ACTIVITY_ID activity_id = 21; // Caption: Activity ID;
	int32 actual_permissions = 22; // Caption: Actual Permissions;
	ocsf.v1_0_0.events.system.enums.MEMORY_ACTIVITY_CLASS_UID class_uid = 23; // Caption: Class ID;
	ocsf.v1_0_0.events.system.enums.MEMORY_ACTIVITY_STATUS_ID status_id = 24; // Caption: Status ID;
	ocsf.v1_0_0.objects.Api api = 25; // Caption: API Details; Profile: cloud;
	int64 end_time = 26; // Caption: End Time;
	string base_address = 27; // Caption: Base Address;
	string category_name = 28; // Caption: Category;
	ocsf.v1_0_0.objects.Actor actor = 29; // Caption: Actor;
	string severity = 30; // Caption: Severity;
	string class_name = 31; // Caption: Class;
	string raw_data = 32; // Caption: Raw Data;
	int32 duration = 33; // Caption: Duration;
	ocsf.v1_0_0.objects.Device device = 34; // Caption: Device;
	ocsf.v1_0_0.objects.Process process = 35; // Caption: Process;
	ocsf.v1_0_0.events.system.enums.MEMORY_ACTIVITY_DISPOSITION_ID disposition_id = 36; // Caption: Disposition ID; Profile: security_control;
	string status = 37; // Caption: Status;
	repeated ocsf.v1_0_0.objects.Observable observables = 38; // Caption: Observables;
	string activity_name = 39; // Caption: Activity;
}

// Event: system
// Event UID: 5
// URL: https://schema.ocsf.io/1.0.0/classes/module_activity
message ModuleActivity {
	string status_code = 1; // Caption: Status Code;
	ocsf.v1_0_0.objects.Object unmapped = 2; // Caption: Unmapped Data;
	ocsf.v1_0_0.objects.Cloud cloud = 3; // Caption: Cloud; Profile: cloud;
	ocsf.v1_0_0.objects.Device device = 4; // Caption: Device;
	string raw_data = 5; // Caption: Raw Data;
	ocsf.v1_0_0.objects.Api api = 6; // Caption: API Details; Profile: cloud;
	string status_detail = 7; // Caption: Status Details;
	string disposition = 8; // Profile: security_control; Caption: Disposition;
	int64 start_time = 9; // Caption: Start Time;
	string status = 10; // Caption: Status;
	int64 end_time = 11; // Caption: End Time;
	int32 duration = 12; // Caption: Duration;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 13; // Caption: Enrichments;
	string activity_name = 14; // Caption: Activity;
	ocsf.v1_0_0.events.system.enums.MODULE_ACTIVITY_STATUS_ID status_id = 15; // Caption: Status ID;
	ocsf.v1_0_0.events.system.enums.MODULE_ACTIVITY_TYPE_UID type_uid = 16; // Caption: Type ID;
	repeated ocsf.v1_0_0.objects.Observable observables = 17; // Caption: Observables;
	int32 count = 18; // Caption: Count;
	string class_name = 19; // Caption: Class;
	string category_name = 20; // Caption: Category;
	string type_name = 21; // Caption: Type Name;
	ocsf.v1_0_0.objects.Actor actor = 22; // Caption: Actor;
	ocsf.v1_0_0.objects.Module module = 23; // Caption: Module;
	ocsf.v1_0_0.events.system.enums.MODULE_ACTIVITY_DISPOSITION_ID disposition_id = 24; // Caption: Disposition ID; Profile: security_control;
	repeated ocsf.v1_0_0.objects.Attack attacks = 25; // Caption: Attacks; Profile: security_control;
	ocsf.v1_0_0.events.system.enums.MODULE_ACTIVITY_SEVERITY_ID severity_id = 26; // Caption: Severity ID;
	ocsf.v1_0_0.events.system.enums.MODULE_ACTIVITY_CLASS_UID class_uid = 27; // Caption: Class ID;
	ocsf.v1_0_0.objects.Metadata metadata = 28; // Caption: Metadata;
	int64 time = 29; // Caption: Event Time;
	string message = 30; // Caption: Message;
	ocsf.v1_0_0.events.system.enums.MODULE_ACTIVITY_CATEGORY_UID category_uid = 31; // Caption: Category ID;
	ocsf.v1_0_0.events.system.enums.MODULE_ACTIVITY_ACTIVITY_ID activity_id = 32; // Caption: Activity ID;
	repeated ocsf.v1_0_0.objects.Malware malware = 33; // Profile: security_control; Caption: Malware;
	int32 timezone_offset = 34; // Caption: Timezone Offset;
	string severity = 35; // Caption: Severity;
}

// Event: system
// Event UID: 7
// URL: https://schema.ocsf.io/1.0.0/classes/process_activity
message ProcessActivity {
	int32 requested_permissions = 1; // Caption: Requested Permissions;
	int64 end_time = 2; // Caption: End Time;
	string disposition = 3; // Caption: Disposition; Profile: security_control;
	ocsf.v1_0_0.events.system.enums.PROCESS_ACTIVITY_DISPOSITION_ID disposition_id = 4; // Caption: Disposition ID; Profile: security_control;
	repeated ocsf.v1_0_0.objects.Observable observables = 5; // Caption: Observables;
	ocsf.v1_0_0.events.system.enums.PROCESS_ACTIVITY_ACTIVITY_ID activity_id = 6; // Caption: Activity ID;
	ocsf.v1_0_0.events.system.enums.PROCESS_ACTIVITY_INJECTION_TYPE_ID injection_type_id = 7; // Caption: Injection Type ID;
	ocsf.v1_0_0.objects.Process process = 8; // Caption: Process;
	string severity = 9; // Caption: Severity;
	string status = 10; // Caption: Status;
	string activity_name = 11; // Caption: Activity;
	ocsf.v1_0_0.objects.Device device = 12; // Caption: Device;
	ocsf.v1_0_0.events.system.enums.PROCESS_ACTIVITY_STATUS_ID status_id = 13; // Caption: Status ID;
	ocsf.v1_0_0.events.system.enums.PROCESS_ACTIVITY_CLASS_UID class_uid = 14; // Caption: Class ID;
	string status_detail = 15; // Caption: Status Details;
	repeated ocsf.v1_0_0.objects.Attack attacks = 16; // Caption: Attacks; Profile: security_control;
	int64 time = 17; // Caption: Event Time;
	int32 exit_code = 18; // Caption: Exit Code;
	ocsf.v1_0_0.events.system.enums.PROCESS_ACTIVITY_CATEGORY_UID category_uid = 19; // Caption: Category ID;
	ocsf.v1_0_0.objects.Metadata metadata = 20; // Caption: Metadata;
	int64 start_time = 21; // Caption: Start Time;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 22; // Caption: Enrichments;
	repeated ocsf.v1_0_0.objects.Malware malware = 23; // Caption: Malware; Profile: security_control;
	ocsf.v1_0_0.objects.Actor actor = 24; // Caption: Actor;
	string type_name = 25; // Caption: Type Name;
	ocsf.v1_0_0.objects.Api api = 26; // Caption: API Details; Profile: cloud;
	string status_code = 27; // Caption: Status Code;
	ocsf.v1_0_0.objects.Object unmapped = 28; // Caption: Unmapped Data;
	int32 timezone_offset = 29; // Caption: Timezone Offset;
	int32 duration = 30; // Caption: Duration;
	string message = 31; // Caption: Message;
	string category_name = 32; // Caption: Category;
	string raw_data = 33; // Caption: Raw Data;
	ocsf.v1_0_0.events.system.enums.PROCESS_ACTIVITY_TYPE_UID type_uid = 34; // Caption: Type ID;
	string class_name = 35; // Caption: Class;
	ocsf.v1_0_0.events.system.enums.PROCESS_ACTIVITY_SEVERITY_ID severity_id = 36; // Caption: Severity ID;
	ocsf.v1_0_0.objects.Cloud cloud = 37; // Caption: Cloud; Profile: cloud;
	int32 count = 38; // Caption: Count;
	string injection_type = 39; // Caption: Injection Type;
	int32 actual_permissions = 40; // Caption: Actual Permissions;
	ocsf.v1_0_0.objects.Module module = 41; // Caption: Module;
}

// Event: system
// Event UID: 2
// URL: https://schema.ocsf.io/1.0.0/classes/registry_value_activity
message RegistryValueActivity {
	ocsf.v1_0_0.objects.Object unmapped = 1; // Caption: Unmapped Data;
	ocsf.v1_0_0.objects.Metadata metadata = 2; // Caption: Metadata;
	string message = 3; // Caption: Message;
	string raw_data = 4; // Caption: Raw Data;
	ocsf.v1_0_0.objects.Device device = 5; // Caption: Device;
	ocsf.v1_0_0.events.system.enums.REGISTRY_VALUE_ACTIVITY_CATEGORY_UID category_uid = 6; // Caption: Category ID;
	ocsf.v1_0_0.events.system.enums.REGISTRY_VALUE_ACTIVITY_CLASS_UID class_uid = 7; // Caption: Class ID;
	ocsf.v1_0_0.objects.Actor actor = 8; // Caption: Actor;
	int64 end_time = 9; // Caption: End Time;
	ocsf.v1_0_0.objects.Api api = 10; // Caption: API Details; Profile: cloud;
	repeated ocsf.v1_0_0.objects.Malware malware = 11; // Caption: Malware; Profile: security_control;
	int32 timezone_offset = 12; // Caption: Timezone Offset;
	int64 time = 13; // Caption: Event Time;
	string type_name = 14; // Caption: Type Name;
	string status_code = 15; // Caption: Status Code;
	ocsf.v1_0_0.objects.Cloud cloud = 16; // Caption: Cloud; Profile: cloud;
	ocsf.v1_0_0.objects.RegistryValue reg_value = 17; // Caption: Registry Value;
	string status = 18; // Caption: Status;
	string activity_name = 19; // Caption: Activity;
	repeated ocsf.v1_0_0.objects.Observable observables = 20; // Caption: Observables;
	ocsf.v1_0_0.events.system.enums.REGISTRY_VALUE_ACTIVITY_SEVERITY_ID severity_id = 21; // Caption: Severity ID;
	string disposition = 22; // Caption: Disposition; Profile: security_control;
	ocsf.v1_0_0.events.system.enums.REGISTRY_VALUE_ACTIVITY_ACTIVITY_ID activity_id = 23; // Caption: Activity ID;
	repeated ocsf.v1_0_0.objects.Attack attacks = 24; // Caption: Attacks; Profile: security_control;
	string class_name = 25; // Caption: Class;
	int32 duration = 26; // Caption: Duration;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 27; // Caption: Enrichments;
	ocsf.v1_0_0.objects.RegistryValue prev_reg_value = 28; // Caption: Previous Registry Value;
	string severity = 29; // Caption: Severity;
	int32 count = 30; // Caption: Count;
	ocsf.v1_0_0.events.system.enums.REGISTRY_VALUE_ACTIVITY_TYPE_UID type_uid = 31; // Caption: Type ID;
	string category_name = 32; // Caption: Category;
	string status_detail = 33; // Caption: Status Details;
	ocsf.v1_0_0.events.system.enums.REGISTRY_VALUE_ACTIVITY_STATUS_ID status_id = 34; // Caption: Status ID;
	ocsf.v1_0_0.events.system.enums.REGISTRY_VALUE_ACTIVITY_DISPOSITION_ID disposition_id = 35; // Caption: Disposition ID; Profile: security_control;
	int64 start_time = 36; // Caption: Start Time;
}

// Event: system
// Event UID: 0
// URL: https://schema.ocsf.io/1.0.0/classes/system
message System {
	int64 start_time = 1; // Caption: Start Time;
	ocsf.v1_0_0.objects.Cloud cloud = 2; // Caption: Cloud; Profile: cloud;
	ocsf.v1_0_0.objects.Object unmapped = 3; // Caption: Unmapped Data;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 4; // Caption: Enrichments;
	string disposition = 5; // Caption: Disposition; Profile: security_control;
	ocsf.v1_0_0.events.system.enums.SYSTEM_DISPOSITION_ID disposition_id = 6; // Caption: Disposition ID; Profile: security_control;
	repeated ocsf.v1_0_0.objects.Malware malware = 7; // Caption: Malware; Profile: security_control;
	ocsf.v1_0_0.events.system.enums.SYSTEM_CLASS_UID class_uid = 8; // Caption: Class ID;
	int32 timezone_offset = 9; // Caption: Timezone Offset;
	ocsf.v1_0_0.objects.Actor actor = 10; // Caption: Actor;
	repeated ocsf.v1_0_0.objects.Attack attacks = 11; // Caption: Attacks; Profile: security_control;
	ocsf.v1_0_0.objects.Metadata metadata = 12; // Caption: Metadata;
	string status = 13; // Caption: Status;
	repeated ocsf.v1_0_0.objects.Observable observables = 14; // Caption: Observables;
	string activity_name = 15; // Caption: Activity;
	string severity = 16; // Caption: Severity;
	int64 time = 17; // Caption: Event Time;
	int32 count = 18; // Caption: Count;
	string raw_data = 19; // Caption: Raw Data;
	int32 duration = 20; // Caption: Duration;
	ocsf.v1_0_0.objects.Device device = 21; // Caption: Device;
	string message = 22; // Caption: Message;
	string class_name = 23; // Caption: Class;
	int64 end_time = 24; // Caption: End Time;
	string status_code = 25; // Caption: Status Code;
	ocsf.v1_0_0.events.system.enums.SYSTEM_STATUS_ID status_id = 26; // Caption: Status ID;
	string type_name = 27; // Caption: Type Name;
	ocsf.v1_0_0.events.system.enums.SYSTEM_ACTIVITY_ID activity_id = 28; // Caption: Activity ID;
	string category_name = 29; // Caption: Category;
	ocsf.v1_0_0.events.system.enums.SYSTEM_CATEGORY_UID category_uid = 30; // Caption: Category ID;
	ocsf.v1_0_0.objects.Api api = 31; // Caption: API Details; Profile: cloud;
	ocsf.v1_0_0.events.system.enums.SYSTEM_SEVERITY_ID severity_id = 32; // Caption: Severity ID;
	ocsf.v1_0_0.events.system.enums.SYSTEM_TYPE_UID type_uid = 33; // Caption: Type ID;
	string status_detail = 34; // Caption: Status Details;
}

// Event: system
// Event UID: 3
// URL: https://schema.ocsf.io/1.0.0/classes/resource_activity
message ResourceActivity {
	string type_name = 1; // Caption: Type Name;
	repeated ocsf.v1_0_0.objects.Observable observables = 2; // Caption: Observables;
	string status = 3; // Caption: Status;
	ocsf.v1_0_0.objects.Device device = 4; // Caption: Device;
	int64 start_time = 5; // Caption: Start Time;
	repeated ocsf.v1_0_0.objects.Malware malware = 6; // Caption: Malware; Profile: security_control;
	repeated ocsf.v1_0_0.objects.Enrichment enrichments = 7; // Caption: Enrichments;
	int32 timezone_offset = 8; // Caption: Timezone Offset;
	repeated ocsf.v1_0_0.objects.Attack attacks = 9; // Caption: Attacks; Profile: security_control;
	string class_name = 10; // Caption: Class;
	ocsf.v1_0_0.events.system.enums.RESOURCE_ACTIVITY_SEVERITY_ID severity_id = 11; // Caption: Severity ID;
	ocsf.v1_0_0.events.system.enums.RESOURCE_ACTIVITY_DISPOSITION_ID disposition_id = 12; // Caption: Disposition ID; Profile: security_control;
	int64 time = 13; // Caption: Event Time;
	string status_code = 14; // Caption: Status Code;
	ocsf.v1_0_0.events.system.enums.RESOURCE_ACTIVITY_TYPE_UID type_uid = 15; // Caption: Type ID;
	ocsf.v1_0_0.objects.Cloud cloud = 16; // Profile: cloud; Caption: Cloud;
	ocsf.v1_0_0.objects.Actor actor = 17; // Caption: Actor;
	string severity = 18; // Caption: Severity;
	ocsf.v1_0_0.events.system.enums.RESOURCE_ACTIVITY_ACTIVITY_ID activity_id = 19; // Caption: Activity ID;
	string message = 20; // Caption: Message;
	string category_name = 21; // Caption: Category;
	ocsf.v1_0_0.objects.Api api = 22; // Caption: API Details; Profile: cloud;
	int32 duration = 23; // Caption: Duration;
	string status_detail = 24; // Caption: Status Details;
	ocsf.v1_0_0.events.system.enums.RESOURCE_ACTIVITY_CATEGORY_UID category_uid = 25; // Caption: Category ID;
	ocsf.v1_0_0.events.system.enums.RESOURCE_ACTIVITY_CLASS_UID class_uid = 26; // Caption: Class ID;
	ocsf.v1_0_0.objects.WinResource win_resource = 27; // Caption: Windows Resource;
	string raw_data = 28; // Caption: Raw Data;
	ocsf.v1_0_0.events.system.enums.RESOURCE_ACTIVITY_STATUS_ID status_id = 29; // Caption: Status ID;
	ocsf.v1_0_0.objects.Object unmapped = 30; // Caption: Unmapped Data;
	string disposition = 31; // Caption: Disposition; Profile: security_control;
	ocsf.v1_0_0.objects.Metadata metadata = 32; // Caption: Metadata;
	string activity_name = 33; // Caption: Activity;
	int32 count = 34; // Caption: Count;
	int64 end_time = 35; // Caption: End Time;
}