Open Cybersecurity Schema Framework

The Reputation object describes the reputation/risk score of an entity (e.g. device, user, domain).

Visualizer

Name Caption Requirement Type Description

base_score Reputation Score Required Float The reputation score as reported by the event source.

provider Provider Recommended String The provider of the reputation information.

score

Reputation Score

Optional

String

The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source.

This is the string sibling of enum attribute score_id.

score_id

Reputation Score ID

Required

Integer

The normalized reputation score identifier.

`0`	Unknown The reputation score is unknown.
`1`	Very Safe Long history of good behavior.
`2`	Safe Consistently good behavior.
`3`	Probably Safe Reasonable history of good behavior.
`4`	Leans Safe Starting to establish a history of normal behavior.
`5`	May not be Safe No established history of normal behavior.
`6`	Exercise Caution Starting to establish a history of suspicious or risky behavior.
`7`	Suspicious/Risky A site with a history of suspicious or risky behavior. (spam, scam, potentially unwanted software, potentially malicious).
`8`	Possibly Malicious Strong possibility of maliciousness.
`9`	Probably Malicious Indicators of maliciousness.
`10`	Malicious Proven evidence of maliciousness.
`99`	Other The reputation score is not mapped. See the `rep_score` attribute, which contains a data source specific value.

This is an enum attribute; its string sibling is score.