type win-sc: EntityItemFileTypeType 0..1 The type of the file. This value can be obtained using the GetFileType function with the exception of which is obtained by looking at the GetFileAttributesEx function. development_class oval-sc: EntityItemStringType 0..1 false The development environment in which the file was created. The current development environments are the general distribution releases (GDR) development environment and the quick fix engineering (QFE) development environment. This MUST be the text prior to the mmmmmm-nnnn component of the file version formats. This value can be obtained via the VarQueryValue function. company oval-sc: EntityItemStringType 0..1 false The name of the company that created the file. This value can be obtained via the VarQueryValue function or the FileVersionInfo class. internal_name oval-sc: EntityItemStringType 0..1 false The internal name of the file.
This value can be obtained via the VarQueryValue function or the FileVersionInfo class. language oval-sc: EntityItemStringType 0..1 The description string for the Microsoft Language Identifier associated with the file. This value can be obtained via the VarQueryValue function or the FileVersionInfo class. original_filename oval-sc: EntityItemStringType 0..1 false The original name of the file when it was created. This value can be obtained via the VarQueryValue function or the FileVersionInfo class. product_name oval-sc: EntityItemStringType 0..1 The name of the product that the file is distributed with. This value can be obtained via the VarQueryValue function or the FileVersionInfo class. product_version oval-sc: EntityItemVersionType 0..1 The version of the product that the file is distributed with. This can be obtained via the VarQueryValue function or the FileVersionInfo class. windows_view win-sc: EntityItemWindowsViewType 0..1 false The targeted file system view where the file or directory was collected.
user account, group account, or logon session. If an operation other than equals is used to identify the matching trustees, then the resulting matches MUST be limited to the trustees explicitly referenced in the file or directory's security descriptor. filter oval-def:filter 0..* false Allows for the explicit inclusion or exclusion of from the set of collected by a Please see the OVAL Language Specification [2] for additional information. FileEffectiveRights53Behaviors The FileEffectiveRights53Behaviors construct defines the behaviors that direct how the fileeffectiverights53_object collects fileeffectiverights53_items from the system. Note that using these behaviors may result in some unique results. For example, a double negative type condition might be created where an object entity says include everything except a specific item, but a behavior is used that might then add that item back in. Also note that FileEffectsRights53Behaviors construct extends the FileBehaviors construct so the max_depth and recurse_direction behaviors are not listed here. Attribute Type Possible Values Description include_group boolean 'true' 'false' Defines whether or not the group SID should be collected when the trustee_sid property specifies a group SID.
printer_name oval-def: EntityStateStringType 0..1 false A printer that a user may have rights on. The printer name SHOULD align with the guidance provided in the MSDN documentation. trustee_sid oval-def: EntityStateStringType 0..1 false The unique SID associated with a user, system, or program (such as a Windows service). standard_delete oval-def: EntityStateBoolType 0..1 false The to delete the printer object. oval-def: EntityStateBoolType 0..1 false The right to read the information in the printer object's Security Descriptor, not including the information in the system access control list (SACL). standard_write_dac oval-def: EntityStateBoolType 0..1 false The right to modify the DACL in the printer object's Security Descriptor. oval-def: EntityStateBoolType 0..1 false The right to change the owner in the printer object's Security Descriptor. oval-def: EntityStateBoolType 0..1 The right to use the printer object for synchronization. This enables a thread to wait until the file is in the signaled state. oval-def: EntityStateBoolType 0..1 false Indicates access to a system access control list (SACL). generic_read oval-def: EntityStateBoolType 0..1 false Read access. generic_write oval-def: EntityStateBoolType 0..1 false Write access. generic_execute oval-def: EntityStateBoolType 0..1 false Execute access . generic_all oval-def: EntityStateBoolType 0..1 Read, write, and execute access. oval-def: EntityStateBoolType 0..1 false Access to perform administrative tasks, which include pausing the printer, deleting all print jobs, resuming a paused printer,
oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to replace a process-level token. seauditprivilege oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to generate security audits. sebackupprivilege oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to back up files and directories. If this privilege is held, the READ_CONTROL, ACCESS_SYSTEM_SECURITY, FILE_GENERIC_READ, and FILE_TRAVERSE rights are granted. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to bypass traverse checking. This privilege is enabled by default for all users. oval-def: EntityStateBoolType 0..1 Gives the user the privilege to create global objects. It is enabled by default for administrators, services, and the local system account. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to create a pagefile. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to create permanent shared object. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to create symbolic links. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to create a token object. sedebugprivilege oval-def: EntityStateBoolType 0..1 Gives the user the privilege to debug programs, especially to debug and adjust the memory of a process owned by another account. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to enable computer and user accounts to be trusted for delegation. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to impersonate a client after authentication. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to increase scheduling priority.
oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to adjust memory quotas for a process. oval-def: EntityStateBoolType 0..1 false the user the privilege to increase a process working set. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to load and unload device drivers. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to lock pages in memory. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to add workstations to domain. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to manage the files on a volume. oval-def: EntityStateBoolType 0..1 Gives the user the privilege to profile a single process. serelabelprivilege oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to modify an object label. oval-def: EntityStateBoolType 0..1 false the user the privilege to force shutdown from a remote system. serestoreprivilege oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to restore files and directories. The following access rights are granted if this privilege is held: WRITE_DAC, WRITE_OWNER, ACCESS_SYSTEM_SECURITY, FILE_GENERIC_WRITE, FILE_ADD_FILE, FILE_ADD_SUBDIRECTORY, and DELETE. sesecurityprivilege oval-def: EntityStateBoolType 0..1 Gives the user the privilege to manage auditing and security log. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to shut down the system. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to synchronize directory service data. This privilege enables the holder to read all objects and properties in the directory, regardless of the
protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to modify firmware environment values, especially to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to profile system performance. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to change the system time. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to take ownership of files or other objects. It allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object. setcbprivilege oval-def: EntityStateBoolType 0..1 Gives the user the privilege to act as part of the operating system, i.e. as part of the Trusted Computer Base (TCB). Some trusted protected subsystems are granted this privilege. setimezoneprivilege oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to change the time zone. seundockprivilege oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to remove the computer from a docking station. oval-def: EntityStateBoolType 0..1 Allows the user to read unsolicited input from a terminal device. sebatchlogonright oval-def: EntityStateBoolType 0..1 false Grants the for an account to log on using the batch logon type.
oval-def: EntityStateBoolType 0..1 false Grants the for an account to log on using the interactive logon type. oval-def: EntityStateBoolType 0..1 false Grants the right for an account to log on using the network logon type. oval-def: EntityStateBoolType 0..1 false Grants the for an account to log on remotely using the interactive logon type. seservicelogonright oval-def: EntityStateBoolType 0..1 Grants the right for an account to log on using the service logon type. oval-def: EntityStateBoolType 0..1 false Denies the for an account to log on using the batch logon type. oval-def: EntityStateBoolType 0..1 false Denies the right for an account to log on using the interactive logon type. oval-def: EntityStateBoolType 0..1 Denies the right for an account to log on using the network logon type. oval-def: EntityStateBoolType 0..1 false Denies the right for an account to log on remotely using the interactive logon type. oval-def: EntityStateBoolType 0..1 false Denies the right for an account to log on using the service logon type. oval-def: EntityStateBoolType 0..1 false Gives the user the privilege to access Credential Manager as a trusted caller. NOTE: This is a privilege (referred to as not a right. win-sc:accesstoken_item The accesstoken_item construct information about the individual privileges and rights associated with a specific access token. All attributes ending in "privilege" are considered access token privileges, and all attributes ending in "right", with the exception of setrustedcredmanaccessnameright, which is a privilege, are access token rights. This item has been deprecated and will be removed in version 6.0 of the language. Due to scalability issues, it is encouraged that you use the userright_item.
oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to create symbolic links. oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to create a token object. sedebugprivilege oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to debug programs, especially to debug and adjust the memory of a process owned by another account. oval-sc:EntityItemBoolType 0..1 Gives the user the privilege to enable computer and user accounts to be trusted for delegation. oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to impersonate a client after authentication. oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to increase scheduling priority. oval-sc:EntityItemBoolType 0..1 Gives the user the privilege to adjust memory quotas for a process. oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to increase a process working set. oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to load and unload device drivers. oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to lock pages in memory. oval-sc:EntityItemBoolType 0..1 Gives the user the privilege to add workstations to domain. oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to manage the files on a volume. oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to profile a single process. serelabelprivilege oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to modify an object label. oval-sc:EntityItemBoolType 0..1 Gives the user the privilege to force shutdown from a remote system. serestoreprivilege oval-sc:EntityItemBoolType 0..1 false Gives the user the privilege to restore files and directories. The following access rights are granted if this privilege is held: WRITE_DAC,
access to an object, and process exit. win-def: EntityStateAuditType 0..1 false The OS MUST attempts to access the directory service. logon 0..1 The OS MUST audit each time this computer validates the credentials of an account. object_access win-def: EntityStateAuditType 0..1 false The OS MUST audit each instance of user attempts to access a non-Active Directory object, such as a file, that has its own system access control (SACL) specified. The type of access request, such as Write, Read, or Modify, and the account making the request MUST match the settings in the SACL. policy_change win-def: EntityStateAuditType 0..1 false The OS must audit attempts to change Policy object rules, such as user rights assignment policy, audit policy, account policy, or trust policy. privilege_use win-def: EntityStateAuditType 0..1 false The OS must audit each instance of user attempts to use privileges. system win-def: EntityStateAuditType 0..1 false The OS must audit attempts to change the system time, startup, restart, or shutdown the system, and load extensible authentication features. Also, it should audit the loss of audited events due to auditing system failure and any instance of a security log size that exceeds a configurable warning threshold level.
SIDs should be resolved and collected. Note that all child groups should also be resolved and any valid domain accounts that are members should also be included. The intent of this behavior is to end up with a list of all individual users from that system that make up the group once everything has been resolved. 'true': The members of a SID MUST be resolved and collected. 'false': The members of a group SID MUST NOT be resolved or collected. Default Value: false win-def:sid_state The sid_state construct is used by a sid_test to specify the different rights that can be associated with a sid_object under Microsoft Windows platforms. Property Type Description trustee_name oval-def: EntityStateStringType 0..1 false The trustee_name property is the unique name in Windows) that
Property Type Multiplicity Nillable Description group_sid oval-sc: EntityItemStringType 0..1 false The group_sid construct holds string that represents the SID of a particular group. user_sid oval-sc: EntityItemStringType 0..* false The user construct represents the SID of a particular user. subgroup_sid oval-sc: EntityItemStringType 0..* The subgroup_sid entity holds a string that represents the SID of particular subgroup in the specified group. win-def:metabase_test The metabase_test is used to make assertions about information found in the Windows metabase. The metabase_test MUST reference one metabase_object and zero or more metabase_states.