{
  "file": "object-fields.v1.json",
  "version": 1,
  "registered_at": "2026-09-02",
  "status": "registered",
  "governance": "M2 登记的行为事件 typed object 与断言字段权威定义。字段增删或语义变化须经模型评审；mapping 侧语义变化必须创建新 mapping_id。内部属性与旧 roles.* 的逐条对照归迁移矩阵与人工复核，本文件只登记目标结构。",
  "entity_type_enum_source": "log-model/docs/main/07-sdm-event-behavior.schema.json#$defs/entity_type",
  "roles_note": "subject/object 对全部 16 类型开放；carriers[] 仅 carrier=true 的 9 类（host/process/file/service/resource/application/container/script/account）；observation.observer 仅 observer=true 的 9 类（entity_type 可为 null=类型未知）。",
  "entity_types": [
    {
      "type": "user",
      "title": "用户",
      "carrier": false,
      "observer": true,
      "fields": [
        {"name": "name", "meaning": "显示名"},
        {"name": "uid", "meaning": "身份标识"},
        {"name": "domain", "meaning": "目录域"},
        {"name": "groups", "meaning": "所属组，数组；对齐 OCSF group 对象与 UDM user.group_identifiers", "nested": ["name", "uid", "type"]}
      ],
      "notes": ["process.user 是进程属主，不升成独立类型"]
    },
    {
      "type": "account",
      "title": "账号",
      "carrier": true,
      "observer": true,
      "fields": [
        {"name": "name", "meaning": "账号名"}
      ],
      "notes": ["权限/角色字段待评审扩展，不在此发明 privilege", "认证/登录类事件里作为载体承载「被登录账号」（carrier_role 建议 principal）：两端 IP 已按投影占用 subject/object，账号无第二个角色位，故走载体而不进 facets、也不写成 assertion 主张"]
    },
    {
      "type": "host",
      "title": "主机",
      "carrier": true,
      "observer": true,
      "fields": [
        {"name": "id", "meaning": "资产中心编号；与 ref_id host::{id} 同一自然键；资产编号只允许登记本字段或 {party}.endpoint.asset_id（同一资产必须同值）"},
        {"name": "name", "meaning": "主机名"},
        {"name": "ip", "meaning": "地址，单值；不并列 ipv4/ipv6"},
        {"name": "mac", "meaning": "MAC 地址（可选）"},
        {"name": "os", "meaning": "操作系统", "nested": ["name", "type", "version", "bit", "build"]},
        {"name": "hw_info", "meaning": "硬件画像；对齐 OCSF device.hw_info", "nested": ["cores", "ram_size", "serial_number", "vendor_name", "model", "bios_ver", "bios_date"]},
        {"name": "network_interfaces", "meaning": "网卡列表，数组；对齐 OCSF network_interface", "nested": ["name", "ip", "mac", "hostname"]},
        {"name": "geo", "meaning": "地理位置富化；continent_name 为统一中文洲名，country_code 为 ISO 3166-1 alpha-2 大写国家/地区代码，均为可选字符串；无值省略，禁止空 {}", "nested": ["continent_name", "country", "country_code", "province", "city", "latitude", "longitude"]},
        {"name": "system", "meaning": "所属业务系统（来源或 CMDB 富化）", "nested": ["id", "name"]},
        {"name": "organization", "meaning": "所属组织/部门（来源或 CMDB 富化）", "nested": ["id", "name"]}
      ],
      "notes": ["多地址归富化/画像治理；geo 不是独立类型", "system/organization 与 extensions.profiles.endpoint_asset 同语义时优先写对象字段", "责任人走 profiles.endpoint_asset.ownership.owner，不登记 host.owner", "嵌套对象无有值叶子时省略该键，不得写 {}"]
    },
    {
      "type": "endpoint",
      "title": "端点",
      "carrier": false,
      "observer": true,
      "fields": [
        {"name": "ip", "meaning": "地址，单值"},
        {"name": "port", "meaning": "端口"},
        {"name": "mac", "meaning": "MAC 地址（可选）"},
        {"name": "asset_id", "meaning": "资产系统（CMDB/资产中心）里该设备的唯一编号；端点身份仍是 ip，本字段不参与 ref_id；与同一资产在 host.id / device.id 上的编号必须同值"},
        {"name": "asset_name", "meaning": "资产系统（CMDB/资产中心）里该资产的名称；与 host.name（主机名）口径不同，判定出实体且来源同名时同值"},
        {"name": "asset_type", "meaning": "资产系统里该资产的类型字符串（来源归一化值，不是 device.type 闭集）；判定出实体后按需归一写 device.type / resource.kind"},
        {"name": "geo", "meaning": "地理位置富化；continent_name 为统一中文洲名，country_code 为 ISO 3166-1 alpha-2 大写国家/地区代码，均为可选字符串；无值省略，禁止空 {}", "nested": ["continent_name", "country", "country_code", "province", "city", "latitude", "longitude"]},
        {"name": "system", "meaning": "所属业务系统（来源或 CMDB 富化）", "nested": ["id", "name"]},
        {"name": "organization", "meaning": "所属组织/部门（来源或 CMDB 富化）", "nested": ["id", "name"]}
      ],
      "notes": ["geo 不是独立类型，也不是 facets.network 字段", "asset_id 是资产系统编号，不参与端点身份（ref_id 仍是 endpoint::{ip}）；无富化命中时省略，禁止占位", "asset_id / asset_name / asset_type 是资产系统口径的富化属性：与 host.id / host.name / device.type / resource.kind 同源时必须同值，不得两处各写一套值；asset_type 是来源归一化字符串，不得污染 device.type 闭集", "禁止在 endpoint 下挂空 resource 对象", "嵌套对象无有值叶子时省略该键，不得写 {}"]
    },
    {
      "type": "process",
      "title": "进程",
      "carrier": true,
      "observer": true,
      "fields": [
        {"name": "name", "meaning": "进程名"},
        {"name": "pid", "meaning": "进程 ID"},
        {"name": "guid", "meaning": "进程 GUID（可选）；旧路径 uid 更名"},
        {"name": "command_line", "meaning": "命令行；旧路径 cmdline 更名"},
        {"name": "integrity", "meaning": "完整性级别（Windows）；对齐 OCSF process.integrity / UDM integrity_level_rid"},
        {"name": "created_time", "meaning": "进程创建时间；对齐 OCSF process.created_time"},
        {"name": "terminated_time", "meaning": "进程结束时间；对齐 OCSF process.terminated_time"},
        {"name": "working_directory", "meaning": "工作目录；对齐 OCSF process.working_directory / UDM working_directory"},
        {"name": "auid", "meaning": "审计登录用户 UID；对齐 OCSF Linux process.auid，integer 0..4294967294；-1/4294967295/unset 省略，真实 0 保留；按主机命名空间解释，不是当前真实/有效 UID", "type": "integer", "minimum": 0, "maximum": 4294967294},
        {"name": "euid", "meaning": "观测时进程有效 UID；对齐 OCSF Linux process.euid，integer 0..4294967294；不覆盖 process.user.uid 的既有属主语义，不代表提权后的快照", "type": "integer", "minimum": 0, "maximum": 4294967294},
        {"name": "egid", "meaning": "观测时进程有效 GID；对齐 OCSF Linux process.egid，integer 0..4294967294；真实 0 保留，-1/4294967295/unset 省略；区别于 real_group.uid、文件属组与附加组，不代表变更后快照", "type": "integer", "minimum": 0, "maximum": 4294967294},
        {"name": "real_group", "meaning": "进程真实组；参考 ECS process.real_group，uid/name 为字符串且至少一个有值；uid 是主机/用户命名空间内规范十进制 GID（0..4294967294），真实 0 保留、unset 省略；不是有效组或附加组全集", "nested": ["uid", "name"]},
        {"name": "user", "meaning": "属主（嵌套，不升成独立类型）", "nested_type": "user"},
        {"name": "file", "meaning": "映像（嵌套，不升成独立类型）", "nested_type": "file"}
      ],
      "notes": ["process.user / process.file 是嵌套属主与映像，不升成独立类型", "创建链在 facets.process.ancestry[]，不进对象"]
    },
    {
      "type": "file",
      "title": "文件",
      "carrier": true,
      "observer": false,
      "fields": [
        {"name": "name", "meaning": "文件名"},
        {"name": "path", "meaning": "路径"},
        {"name": "size", "meaning": "大小（可选）"},
        {"name": "mode", "meaning": "POSIX 权限模式，参考 ECS file.mode；四位八进制字符串 0000..7777（含 SUID/SGID/sticky），不含文件类型位或 ACL；符号权限先转换，未知省略", "type": "string", "pattern": "^[0-7]{4}$"},
        {"name": "owner", "meaning": "文件属主；参考 OCSF file.owner.uid/name，字符串 uid/name 至少一个有值；Linux UID 按主机命名空间解释，不是文件自身 ID 或操作进程用户", "nested": ["uid", "name"]},
        {"name": "group", "meaning": "文件所属组；参考 ECS file.gid/group 并沿 SDM 组标识 uid/name 命名，字符串 uid/name 至少一个有值；不是进程真实组或完整 ACL", "nested": ["uid", "name"]},
        {"name": "hashes", "meaning": "哈希属性，不是独立类型", "nested": ["md5", "sha1", "sha256"]},
        {"name": "internal_name", "meaning": "映像内部名（VERSIONINFO / Info.plist）；对齐 OCSF file.internal_name"},
        {"name": "signatures", "meaning": "数字签名，数组；对齐 OCSF file.signatures[] (digital_signature)", "nested": ["algorithm", "certificate", "digest", "state"]},
        {"name": "company_name", "meaning": "映像公司名；对齐 OCSF file.company_name"},
        {"name": "product", "meaning": "产品名；对齐 OCSF file.product"},
        {"name": "version", "meaning": "文件版本；对齐 OCSF file.version"},
        {"name": "desc", "meaning": "文件描述；对齐 OCSF file.desc"}
      ],
      "notes": []
    },
    {
      "type": "service",
      "title": "服务",
      "carrier": true,
      "observer": true,
      "fields": [
        {"name": "name", "meaning": "服务名"},
        {"name": "id", "meaning": "服务编号；映射声明的稳定键；资产编号只允许登记本字段或 {party}.endpoint.asset_id（同一资产必须同值）"},
        {"name": "port", "meaning": "端口（可选）"}
      ],
      "notes": []
    },
    {
      "type": "domain",
      "title": "域名",
      "carrier": false,
      "observer": false,
      "fields": [
        {"name": "name", "meaning": "域名"}
      ],
      "notes": ["解析应答进 facets.dns.answers[]，不挂在对象上"]
    },
    {
      "type": "url",
      "title": "链接",
      "carrier": false,
      "observer": false,
      "fields": [
        {"name": "full", "meaning": "完整 URL"},
        {"name": "path", "meaning": "路径（可选）"},
        {"name": "query", "meaning": "查询串（可选）"}
      ],
      "notes": ["HTTP 请求细节进 facets.http", "facets.http.request.path/query 只承载请求目标上下文，不是 URL 身份；来源为相对 request-target 时不得据此补全 url.full，只有来源给出绝对 URL 且以 URL 为主要客体时才填 full/path/query；同一事实不得在 facet 与 object.url 两处重复"]
    },
    {
      "type": "device",
      "title": "设备",
      "carrier": false,
      "observer": true,
      "fields": [
        {"name": "id", "meaning": "资产中心编号；与 ref_id device::{id} 同一自然键；资产编号只允许登记本字段或 {party}.endpoint.asset_id（同一资产必须同值）"},
        {"name": "vendor", "meaning": "厂商"},
        {"name": "type", "meaning": "设备类型；闭集：server/desktop/laptop/tablet/mobile/virtual/iot/browser/firewall/switch/hub/router/ids/ips/load_balancer/other（对齐 OCSF device.type_id）"},
        {"name": "model", "meaning": "型号（可选）"},
        {"name": "ip", "meaning": "管理地址，单值；多地址余量进 extensions.source_private"},
        {"name": "serial_number", "meaning": "序列号（可选）"}
      ],
      "notes": ["旧 observer.product 不是独立类型，按 device/application/service 分流", "不并列 ipv4/ipv6，不多值 ip_addresses[]"]
    },
    {
      "type": "resource",
      "title": "资源",
      "carrier": true,
      "observer": true,
      "fields": [
        {"name": "id", "meaning": "资源编号；与 ref_id 同一语义键（映射声明的稳定键）；资产编号只允许登记本字段或 {party}.endpoint.asset_id（同一资产必须同值）"},
        {"name": "name", "meaning": "名称"},
        {"name": "kind", "meaning": "资源种类；旧路径 type/subtype 待归一"},
        {"name": "vendor", "meaning": "厂商"},
        {"name": "geo", "meaning": "地理位置富化；continent_name 为统一中文洲名，country_code 为 ISO 3166-1 alpha-2 大写国家/地区代码，均为可选字符串；无值省略，禁止空 {}", "nested": ["continent_name", "country", "country_code", "province", "city", "latitude", "longitude"]},
        {"name": "system", "meaning": "所属业务系统", "nested": ["id", "name"]},
        {"name": "organization", "meaning": "所属组织/部门", "nested": ["id", "name"]}
      ],
      "notes": ["相关资产列表不得写入 system；那不是本实体的业务系统"]
    },
    {
      "type": "application",
      "title": "应用",
      "carrier": true,
      "observer": true,
      "fields": [
        {"name": "name", "meaning": "应用名"},
        {"name": "version", "meaning": "版本（可选）"},
        {"name": "vendor", "meaning": "厂商（对齐 OCSF application.product.vendor_name）"}
      ],
      "notes": []
    },
    {
      "type": "cloud",
      "title": "云",
      "carrier": false,
      "observer": false,
      "fields": [
        {"name": "provider", "meaning": "云厂商"},
        {"name": "account", "meaning": "云账号（可选）"},
        {"name": "region", "meaning": "区域（可选）"}
      ],
      "notes": []
    },
    {
      "type": "container",
      "title": "容器",
      "carrier": true,
      "observer": false,
      "fields": [
        {"name": "id", "meaning": "容器 ID"},
        {"name": "name", "meaning": "名称"},
        {"name": "image", "meaning": "镜像"},
        {"name": "namespace", "meaning": "命名空间（可选）"}
      ],
      "notes": ["K8s 上下文进 facets.container"]
    },
    {
      "type": "certificate",
      "title": "证书",
      "carrier": false,
      "observer": false,
      "fields": [
        {"name": "serial", "meaning": "序列号"},
        {"name": "subject", "meaning": "主体"},
        {"name": "issuer", "meaning": "颁发者"},
        {"name": "not_after", "meaning": "过期时间"}
      ],
      "notes": []
    },
    {
      "type": "script",
      "title": "脚本",
      "carrier": true,
      "observer": false,
      "fields": [
        {"name": "name", "meaning": "脚本名"},
        {"name": "path", "meaning": "路径"},
        {"name": "interpreter", "meaning": "解释器（可选）"}
      ],
      "notes": ["旧注册表为 language/command/content，与 name/path/interpreter 的取舍已裁决为后者"]
    }
  ],
  "assertion": {
    "path_prefix": "observation.assertion",
    "required_when": "observation.action 为 detect/assess 时必须存在",
    "invariant": "断言不反写事实层：attacker[]/victim[]/affected[] 是来源主张，不覆盖 subject/object",
    "fields": [
      {"name": "title", "meaning": "检测标题", "from": "source_finding.title"},
      {"name": "severity", "meaning": "检测严重度；与 meta.source_record.log_level 分轨", "from": "source_finding.severity"},
      {"name": "confidence", "meaning": "置信度；按来源契约保留，不强制 0-100", "from": "source_finding.confidence"},
      {"name": "category", "meaning": "来源检测分类名", "from": "source_finding.category"},
      {"name": "category_code", "meaning": "来源检测分类码", "from": "source_finding.category_code"},
      {"name": "rule", "meaning": "规则/特征 ID", "from": "source_finding.rule.signature_id / source_finding.rule.id / source_finding.rule_id / source_finding.signature"},
      {"name": "attack_direction", "meaning": "攻击者到受害者相对租户网络边界的方向；可选字符串：L2L/L2W/W2L/W2W/unknown；来源断言，不复制通信方向", "from": "source_finding.attack_direction / attacker_direction"},
      {"name": "attacker[]", "json_key": "attacker", "meaning": "攻击者，按来源主张保存", "from": "source_finding.attacker"},
      {"name": "victim[]", "json_key": "victim", "meaning": "受害者，按来源主张保存", "from": "source_finding.victim"},
      {"name": "affected[]", "json_key": "affected", "meaning": "受影响对象，按来源主张保存", "from": "source_finding.affected"},
      {"name": "kill_chain", "meaning": "Cyber Kill Chain 阶段；对齐 OCSF kill_chain_phase，不落来源字符串", "from": "source_finding.kill_chain", "nested": ["phase"]},
      {"name": "mitre", "meaning": "ATT&CK；子字段 tactic/technique/technique_id，禁止平行 assertion.tactic", "from": "source_finding.mitre_*", "nested": ["tactic", "technique", "technique_id"]},
      {"name": "vulnerability", "meaning": "漏洞（CVE 等）", "from": "source_finding.vuln_*"},
      {"name": "malware", "meaning": "恶意软件家族/名称", "from": "source_finding.malware_*"},
      {"name": "conclusion", "meaning": "来源处置结论", "from": "source_finding.action"}
    ],
    "json_key_rule": "字段名里的 `[]` 是数组记号，不是 JSON 键的一部分：物理事件的键为去掉 `[]` 的名字（attacker / victim / affected）。两种写法在校验器里都接受，避免记号被当键名。",
    "entity_arrays": {
      "names": ["attacker[]", "victim[]", "affected[]"],
      "element": "数组元素是实体引用，不是第二份实体快照：ref_id + entity_type + 与 entity_type 同名的 typed object",
      "element_keys": ["ref_id", "entity_type"],
      "leaf_source": "元素 typed object 的叶子必须是 entity_types 中该类型已登记的叶子（含 nested）；未登记的旧路径按 docs/wparse-OML字段树迁移处置表.md 逐条处置，不在此另立白名单",
      "geo_policy": "断言实体允许携带 geo（事实层优先）：同一 ref_id 在 subject/object 已有 geo 时以事实层为准，断言副本仅作缺事实层时的兜底；两处同叶子值不一致判错。叶子用登记命名，旧形状按根级 geo_leaf_aliases 归一。"
    }
  },
  "geo_leaf_aliases": {
    "note": "实体 geo 的旧形状 → 登记叶子。登记叶子见 entity_types[].fields[].nested（geo）。转换器与校验器共用本表，避免各自维护一份别名。",
    "aliases": {
      "continent.name": "continent_name",
      "country.name": "country",
      "country.code": "country_code",
      "region.name": "province",
      "province.name": "province",
      "city.name": "city",
      "coordinates.latitude": "latitude",
      "coordinates.longitude": "longitude"
    }
  }
}