A SignatureSecurityEvent is an event detected by a signature-based sensor (e.g. an Intrusion Detection System (IDS) or anti-virus software)

Attributes
SecurityEventEndpoint	_securityEventEndpoint
SecuritySignature	_securitySignature
String	dataFlowDirection	This indicates the overall flow of data for the connection - inbound implies that more data (bytes) was received by the destination than by the source. Enumeration values: inbound outbound
Integer	numberOfBytes	Total bytes collected by the sensor for the event.
Integer	numberOfPackets	Total packets collected by the sensor for the event
String	packetCaptureData	Text field to capture PCAP (packet capture) data (i.e. full packets involved in the SecurityEvent)

Attributes inherited from  SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Event ABE::SecurityEvent

_securityEvent,  _securityEvent1,  _eventSpecification,  _securityEventCollectionMethod,  _securityVulnerability,  _securityIncident,  comments,  validFor

Attributes inherited from  SID Models::Common Domain::Root Business Entities ABE::Entity

_entityIdentification,  _entityRole,  managedEntity,  characteristicValue

Attributes inherited from  SID Models::Common Domain::Root Business Entities ABE::RootEntity

_rootEntityType,  _revenueAssuranceParmValue,  _characteristicValue,  name,  description,  ID,  metric,  _monitoredMetricInstancesCriteria,  directedEdge,  vertex,  entityCatalogItem,  rootEntityGroupMember,  rootEntityGroup,  rootEntityRelationship,  rootEntityRelationship2,  associationRole,  entitySpecificationAttachment,  interactionUseCase,  interactionResult

 _securityEventEndpoint

Public SecurityEventEndpoint _securityEventEndpoint

Constraints:

Properties:

Aggregation	None
Alias
Association	SecurityEventEndpointInvolvedInSignatureEvent
Association End
Class	SignatureSecurityEvent
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	0..2
Name	_securityEventEndpoint
Name Expression
Namespace	SignatureSecurityEvent
Opposite	_signatureSecurityEvent
Owner	SignatureSecurityEvent
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Event ABE::SignatureSecurityEvent::_securityEventEndpoint
Stereotype
Template Parameter
Type	SecurityEventEndpoint
Upper	2
Upper Value	(2)
Visibility	Public

 _securitySignature

Public SecuritySignature _securitySignature

Constraints:

Properties:

Aggregation	None
Alias
Association	SecuritySignatureDetectedBy
Association End
Class	SignatureSecurityEvent
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	0..1
Name	_securitySignature
Name Expression
Namespace	SignatureSecurityEvent
Opposite	_signatureSecurityEvent
Owner	SignatureSecurityEvent
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Event ABE::SignatureSecurityEvent::_securitySignature
Stereotype
Template Parameter
Type	SecuritySignature
Upper	1
Upper Value	(1)
Visibility	Public

 dataFlowDirection

Public String dataFlowDirection

This indicates the overall flow of data for the connection - inbound implies that more data (bytes) was received by the destination than by the source. Enumeration values:

inbound

outbound

Constraints:

Properties:

Aggregation	None
Alias
Association
Association End
Class	SignatureSecurityEvent
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	0..1
Name	dataFlowDirection
Name Expression
Namespace	SignatureSecurityEvent
Opposite
Owner	SignatureSecurityEvent
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Event ABE::SignatureSecurityEvent::dataFlowDirection
Stereotype	required
Template Parameter
Type	String
Upper	1
Upper Value	(1)
Visibility	Public

 numberOfBytes

Public Integer numberOfBytes

Total bytes collected by the sensor for the event.

Constraints:

Properties:

Aggregation	None
Alias
Association
Association End
Class	SignatureSecurityEvent
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	0..1
Name	numberOfBytes
Name Expression
Namespace	SignatureSecurityEvent
Opposite
Owner	SignatureSecurityEvent
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Event ABE::SignatureSecurityEvent::numberOfBytes
Stereotype	required
Template Parameter
Type	Integer
Upper	1
Upper Value	(1)
Visibility	Public

 numberOfPackets

Public Integer numberOfPackets

Total packets collected by the sensor for the event

Constraints:

Properties:

Aggregation	None
Alias
Association
Association End
Class	SignatureSecurityEvent
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	0..1
Name	numberOfPackets
Name Expression
Namespace	SignatureSecurityEvent
Opposite
Owner	SignatureSecurityEvent
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Event ABE::SignatureSecurityEvent::numberOfPackets
Stereotype	required
Template Parameter
Type	Integer
Upper	1
Upper Value	(1)
Visibility	Public

 packetCaptureData

Public String packetCaptureData

Text field to capture PCAP (packet capture) data (i.e. full packets involved in the SecurityEvent)

Constraints:

Properties:

Aggregation	None
Alias
Association
Association End
Class	SignatureSecurityEvent
Datatype
Default
Default Value
Is Composite	false
Is Derived	false
Is Derived Union	false
Is Leaf	false
Is Ordered	false
Is Read Only	false
Is Static	false
Is Unique	true
Keywords
Lower	0
Lower Value	(0)
Multiplicity	*
Name	packetCaptureData
Name Expression
Namespace	SignatureSecurityEvent
Opposite
Owner	SignatureSecurityEvent
Owning Association
Owning Template Parameter
Qualified Name	SID Models::Enterprise Domain::Enterprise Risk ABE::Enterprise Security ABE::Security Event ABE::SignatureSecurityEvent::packetCaptureData
Stereotype	required
Template Parameter
Type	String
Upper	*
Upper Value	(*)
Visibility	Public