objects.Win_System_Restore_Object.xsd Maven / Gradle / Ivy
The newest version!
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Win_System_Restore_Object
2.1
01/22/2014
The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML.
Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.
Windows_System_Restore_Entry object is intended to characterize Windows system restore points. See also: http://msdn.microsoft.com/en-us/library/windows/desktop/dd408121(v=vs.85).aspx.
The WindowsSystemRestoreObjectType is intended to characterize Windows system restore points.
The description of this restore point.
The full path to the restore point.
The name associated with this restore point.
The type of restore point. (ex: "Checkpoint").
The SID associated with a restore point change log event. This usually appears when the event flag includes "ACL Info".
The username associated with a restore point change log event. It usually appears when the event flag includes "ACL Info".
The backup file name associated with a particular restore point change log event.
The change event associated with this restore point object (ex: "System Checkpoint", "Software Installation", etc.).
The flags associated with a restore point change log entry (ex: "ACL Info, "Short Name", etc.).
The change log sequence number associated with this restore point object.
The changelog entry type associated with this restore point object.
The changelog file associated with the restore point.
The created date of the system restore point.
Attributes of the file associated with this restore point object (ex: "Directory").
The new filename of the file associated with this restore point object.
The original filename associated with this restore point change log event.
The original Short filename (SFN) of the file associated with this restore point object.
The process name associated with this restore point object.
The registry hives associated with this restore point.
HiveListType is intended to characterize a group of keys, subkeys, and values in the Windows registry that has a set of supporting files containing backups of its data and is associated with a system restore point.
http://msdn.microsoft.com/en-us/library/windows/desktop/ms724877(v=vs.85).aspx.
The Hive element specifies the Windows registry hive associated with the system restore point.
ChangeLogEntryTypeType types, via a union of the ChangeLogEntryTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
This attribute is optional and specifies the expected type for the value of the specified property.
The change types found in a Restore Point changelog>.
Represents a changelog entry descriptor for updating an ACL. (0x00000001).
Represents a changelog entry descriptor for updating attributes. (0x00000002).
Represents a changelog entry descriptor for deleting a file. (0x00000004).
Represents a changelog entry descriptor for creating a file. (0x00000010).
Represents a changelog entry descriptor for renaming a file. (0x00000020).
Represents a changelog entry descriptor for creating a directory. (0x00000040).
Represents a changelog entry descriptor for renaming a directory. (0x00000080).
Represents a changelog entry descriptor for deleting a directory. (0x00000100).
Related to filesystem attachment points. (0x00000200).