¶ Object within platform
Object within platform is smallest available piece of structured information. It can be arbitary object within your network. Every module can bring its own object types.
Think about object as some asset within your network which you want to track. For example, this can be person, host, account, software, DNS zone, network interface etc.
Platform uses collections to garther these objects or you can add objects manually by command add.
¶ Object URL
Every object has unique url in format [epoch:]objecttype/objectid. If you omit epoch, actual epoch is used. ID of the object is unique within epoch. Most important feature of object id is that it should be persistent for object during time. This is not as easy as it seems and some collections have no chance to know this technically.
For example, if we are scanning network by nmap, we get list of IPs and their DNS names. If some host changes IP or DNS name in time, nmap has no chance to identify this.
On other side, if we are using Qualys agent, every host has unique id and even if IP or hostname changes, URL of object remains same. Platform can detect and track this changes only if there are collections which contains informations about changes.
¶ Object list
¶ Object hierarchy
Objects are hierarchical. This helps for searching similar objects from different sources. For example, Host object is parent for all other hosts like NmapHost, QualysHost, etc. You can then search just for Qualyshost or for all hosts from all modules.
¶ Object attributes
You can see list of all attributes here: attribute
Every object has definition, which attributes are mandatory and which are optional. By default, only id, imported and modified attribute is required.
¶ Common object attributes
- ID: Primary object ID. It is unique within epoch. Should be persistent for same object in time.
- Name: Name of the object. Does not have to be unique.
- Description: Any kind of longer description
- Tag: List of object tags
- Created: Date when object was created within network. Note this is not date when object was imported into model.
- Imported: Date when object was imported into model.
- Modified: Date when object was last modified within model
- Updated: Date when object was last updated within network
- Removed: Date when object was removed within network
- Deleted: Date when object was deleted from model