This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Object Types

Object types used to describe the entity or entities that are the subject of an event.

When describing what happened in an event there is usually an entity or entities involved in the event, e.g. a user deleting a document, sending an email, creating a virtual session, etc. The majority of the schema actions support acting on one or more instances of the MultiObjectComplexType, this structure describes a choice of the following entity types:

Where the entity involved in the event cannot be described by one of the predefined categories in this structure then the <Object> structure can be used as a last resort.

Common Structural Elements

The following elements are common to all of the above object types;

  • Type - The type of the object in question and specific to the object type from the list above, e.g. a <Resource> object may have a type such as ‘image’ or ‘script’
  • Id - An identifier for the object, e.g a document ID in a document management system
  • Name - The name of the object, e.g. a filename
  • Description - Human readable description of what the object is
  • Classification - Any classification or restrictions placed on the object, e.g. for commercially sensitive reports or user health records (see Basic Structure)
  • State - Any state information about the object, e.g. ‘Archived’
  • Groups - Any groups associated with the object, e.g. group membership of a user account
  • Permissions - Any permissions associated with the object, e.g. write access being granted to a list of named users or groups
  • Data - An extensible structure for additional unstructured data as described in Unstructured Data
  • Meta - An extensible structure for structured meta data as described in Meta Element

1 - Resource

A resource within a web site or web application, e.g. an HTML file.

This is used to describe a resource within a web site or web application, such as an HTML file, image file or script, along with the details of that resource such as size or response codes. It can represent both successful and failed access to the resource object.

2 - Search Results

A set of search results that are independent of the query that generated them.

This element is used to describe a set of search results that have a life beyond the execution of the query that generated them. For example where the execution of the query forms one event and the viewing of the results happens some time later and forms another event.

This element can be used to describe a single result within a result set, a page of results from a larger result set or a full result set.

The separate event for the execution of the search/query that produced the results should be modelled using the <Search> schema action.

See Complete Examples for example events.

3 - Shortcut

Any kind of shortcut or symbolic link.

This should be used to describe any form of shortcut or symbolic link to another object.

4 - User

Describes a user or user account in a system.

This is used to describe a user entity in a system. This could be the user account in a web application, the identity of a person in an access control system, a user profile in a chat application or a user account on a piece of configurable hardware.

The full details of the user can also be recorded, such as the position within the organisation, if known.

It is important to consider that the user account is not necessarily under the control of the person to whom the account has been assigned.

5 - Virtual Session

A screen sharing or remote desktop session.

This object type is used to describe the session used when viewing another user’s session, e.g. screen sharing or remote assistance type activities.

6 - VOIP

A Voice over IP call.

This is used to record a voice over IP call between parties. The <PhoneNumber> element represents the phone number of the calling party.

7 - Association

Any form of association between other objects.

This can be used to describe any form of association between other objects. For example in a social networking type application links are made between user accounts. This <Association> object would allow the creation/modification/deletion of one of these links to be recorded.

8 - Banner

A banner of pop-up displayed to the user.

This is typically used within a <View> schema action and is intended to record the details of a banner, pop-up or warning message that is displayed to a user, along with the version and contents of that message.

Its objective is to record that the user has seen a message alerting them to the terms of use for a particular system.

9 - Chat

A single chat message in an instant message application.

This is used to describe a single message in an instant messaging application. The <SessionId> element can be populated to allow multiple events for the same chat session to be associated at a later date. This is used for direct user to user chat as opposed to <GroupChat> which is used for chatting to a group of users via a chat room.

A chat message is typically modelled within a <Create> schema action.

10 - Configuration

Configuration for a system or piece of hardware.

This describes any form of configuration for a system or piece of hardware, e.g. describing some or all of the configuration of a firewall. Due to the very varied nature of software/hardware configuration there is no additional predefined structure beyond the base object structure.

11 - Criteria

The criteria used in a filter or query.

This is used to describe the criteria applied in any kind of search or filter operation along with the returned results, if known. The <Query> element is used to record the actual query terms used, either in its raw form (e.g. SQL or XPath), as a nested hierarchy of operators and expressions or as a set of simple <Include> or <exclude> elements.

For example, this may be used to describe the criteria for a query that has been stored for re-use, e.g. an <Update>/<Criteria> event where a user is making changes to a stored query but not actually executing the query.

See Complete Examples for example events.

12 - Document

Any form of digital document.

This is used to describe any form of digital document, such as a Word document, PDF or a simple text file, along with its location and most recent created/modified/accessed times.

The <Permissions> element that is part of the base object structure can be used to define all the user/group permissions in place on the document in the case of a document management system or similar.

13 - Email

An email that has been sent or received.

This object type is used to describe an email that has either been sent, received or saved in some way. It can record all parties involved in the email.

14 - File

Any kind of file on a file system.

This is used to describe any kind of file on a file system or file repository, e.g. a data file, log file, backup file, etc. The <Media> element can be used to describe the type of media it is stored on. The hash of the file can also be recorded using <Hash> so the actual version of the file interacted with is known. If a hash is supplied then the name of the hashing algorithm should also be supplied in the Type attribute.

The object type <Document> may be more appropriate unless the file is being referred to in its generic capacity as a file.

15 - Folder

This is very similar to the <File> object type except that it is used to record a folder on a file system or file repository.

16 - Group

A grouping of other objects, e.g. a group of users.

This used to define a group entity, e.g. a group of users. The Group itself may have other groups within it.

17 - Group Chat

A chat message sent to/from a chat room/group.

This is similar to the <Chat> object with the difference that it is for recording a group chat message either from a user to a chat room or from a room to a user.

18 - Object

A generic object type for anything not covered by the other object types.

This is the object type of last resort when the object involved in the event cannot be described using any of the other types. Due to the unknown nature of the object, the <Data> element structure is provided in addition to the base object structure.