diff --git a/CHANGELOG.md b/CHANGELOG.md index 77da2d332..f3e1a429e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -92,6 +92,7 @@ Thankyou! --> 1. Added `vendor_attributes` object. #1257 1. Added `aircraft` object. #1253 1. Added `software_component` and `sbom` objects. #1262 + 1. Added `drive_type` and `drive_type_id` objects. #1286 ### Improved * #### Event Classes @@ -156,6 +157,7 @@ Thankyou! --> 1. Added `cloud_partition` to the `cloud` object. #1271 1. Added `product`, `related_events_count`, `uid_alt`, `tags` to `finding_info` object. #1271 1. Added `count`, `created_time`, `desc`, `first_seen_time`, `last_seen_time`, `modified_time`, `product`, `severity`, `severity_id`, `tags` & `title` to `related_event` object. #1271 + 1. Added `drive_type` and `drive_type_id` to the `file` object. #1286 ### Bugfixes 1. Added sibling definition to `confidence_id` in dictionary, accurately associating `confidence` as its sibling. #1180 diff --git a/dictionary.json b/dictionary.json index 744f622d2..494f82976 100644 --- a/dictionary.json +++ b/dictionary.json @@ -1818,6 +1818,47 @@ "type": "string_t", "is_array": true }, + "drive_type": { + "caption": "Drive Type", + "description": "The type of drive where the file is located. For example: unknown, removable, fixed, remote, or other.", + "type": "string_t" + }, + "drive_type_id" : { + "caption": "Drive Type ID", + "description": "The drive type id where the file is located.", + "sibling": "drive_type", + "type": "integer_t", + "enum": { + "0": { + "caption": "Unknown", + "description": "The drive type is unknown." + }, + "1": { + "caption": "Removable", + "description": "File is located on removable media like a USB stick." + }, + "2": { + "caption": "Fixed", + "description": "File is located on a fixed drive, such as a hard disk." + }, + "3": { + "caption": "Remote", + "description": "File is located on a remote drive, such as a network share." + }, + "4": { + "caption": "CD-ROM", + "description": "File is located on a CD-ROM drive." + }, + "5": { + "caption": "Ram Disk", + "description": "File resides on a RAM disk." + }, + "99": { + "caption": "Other", + "description": "The drive type is not mapped. See the drive_type attribute, which contains a data source specific value." + } + } + }, "driver": { "caption": "Kernel Driver", "description": "The driver that was loaded/unloaded into the kernel", diff --git a/objects/file.json b/objects/file.json index c01680bc0..f5f9fdddf 100644 --- a/objects/file.json +++ b/objects/file.json @@ -42,6 +42,12 @@ "description": "The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type.", "requirement": "optional" }, + "drive_type": { + "requirement": "optional" + }, + "drive_type_id" : { + "requirement": "optional" + }, "encryption_details": { "description": "The encryption details of the file. Should be populated if the file is encrypted.", "requirement": "optional"