The IPPacketFilterIndication class is intended to provide a base set of properties to allow for common data to be logged by all packet filtering services and devices in a consistent manner. This single consistent model of data will allow for common reporting of many messages across different packet filtering systems, which will help improve security information management by providing a single view of the information. | Qualifiers:Experimental Version ( "2.10.0" ) Indication | Parameters (local in grey) | | uint16 TranslatedSourcePort ; The source port after translation when Network Address Translation is performed by the packet filter. | string TranslatedSourceAddress ; The source address after translation when Network Address Translation is performed by the packet filter. | Values { "Unknown" , "DMTF Reserved" , "Not Applicable" , "Connection Accepted" , "Connection Rejected" , "Connection Dropped" , "DMTF Class Reserved" , "Vendor Reserved" } Required Override ( "MessageType" ) ValueMap { "0" , ".." , "2" , "3" , "4" , "5" , "6..100" , "16000.." } uint16 MessageType ; An integer indicating the type of message to which the indication applies. DMTF subclasses will define specific values from the DMTF Class Reserved range. | uint32 TranslatedSourceIPv4NumericAddress ; The source IPv4 address after translation when Network Address Translation is performed by the packet filter. | string TranslatedDestAddress ; The destination address after translation when Network Address Translation is performed by the packet filter. | uint16 TranslatedDestPort ; The destination port after translation when Network Address Translation is performed by the packet filter. | Values { "Ingress" , "Egress" } Required ValueMap { "0" , "1" } uint16 Direction ; An integer indicating the direction of packet traffic from the standpoint of the packet filter. | Values { "DNS" , "NETBIOS" } ValueMap { "0" , "1" } uint16 NamingConvention = 0 ; An integer indicating the naming convention used for host names reported by the packet filter. The default is 'DNS'. | string DestinationServiceName ; The name of the TCP or UDP service that corresponds to the DestPort. | uint32 TranslatedDestIPv4NumericAddress ; The destination IPv4 address after translation when Network Address Translation is performed by the packet filter. | ModelCorrespondence { "CIM_IPPacketFilterIndication.NamingConvention" } string DestinationHostName ; The name of the host that corresponds to the IPv4DestinationAddress or IPv6DestinationAddress. | ModelCorrespondence { "CIM_IPPacketFilterIndication.NamingConvention" } string SourceHostName ; The name of the host that corresponds to the IPv4SourceAddress or IPv6SourceAddress. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.SourceAddress" , "CIM_IPNetworkSecurityIndication.IPv4NumericSourceAddress" } string SourceMACAddress ; The MAC address for the source address for this message from the Detector's point of view. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.SourceAddress" , "CIM_IPNetworkSecurityIndication.IPVersionSupport" } uint8 SourcePrefixLength ; The prefix length for the IPv6 address for the originator of the network traffic associated with this Indication from the Detector's point of view. | Values { "Unknown" , "ARP" , "TCP" , "UDP" , "ICMP" , "IGMP" } Required ValueMap { "0" , "2" , "3" , "4" , "5" , "6" } uint16 Protocol ; An integer indicating the type of network protocol for the traffic associated with this Indication. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.IPv4NumericSourceAddress" , "CIM_IPNetworkSecurityIndication.IPVersionSupport" } string SourceAddress ; The address for the originator of the network traffic associated with this Indication from the Detector's point of view. This address MUST be identical to the IPv4NumericSourceAddress if both property values are not NULL and the IPVersionSupport property is 'IPv4' . | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.DestAddress" , "CIM_IPNetworkSecurityIndication.IPv4NumericDestAddress" } uint32 DestPort ; The port for the destination address for this message from the Detector's point of view. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.DestAddress" , "CIM_IPNetworkSecurityIndication.IPVersionSupport" } uint8 DestPrefixLength ; The prefix length for the IPv6 address for the destination of the network traffic associated with this Indication from the Detector's point of view. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.DestAddress" , "CIM_IPNetworkSecurityIndication.IPv4NumericDestAddress" } string DestMACAddress ; The MAC address for the destination address for this message from the Detector's point of view. | Values { "Unknown" , "IPv4" , "IPv6" } Required ValueMap { "0" , "2" , "3" } uint16 IPVersionSupport ; This property explicitly defines support for different versions of the IP protocol for the traffic associated with this Indication. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.DestAddress" , "CIM_IPNetworkSecurityIndication.IPVersionSupport" } uint32 IPv4NumericDestAddress ; The IPv4 destination address in numeric form. This address MUST be identical to the DestAddress property if both property values are not NULL and the IPVersionSupport property is 'IPv4'. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.SourceAddress" , "CIM_IPNetworkSecurityIndication.IPv4NumericSourceAddress" } uint32 SourcePort ; The port for the source address for this message from the Detector's point of view. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.SourceAddress" , "CIM_IPNetworkSecurityIndication.IPVersionSupport" } uint32 IPv4NumericSourceAddress ; The IPv4 source address in numeric form. This address MUST be identical to the SourceAddress property if both property values are not NULL and the IPVersionSupport property is 'IPv4'. | ModelCorrespondence { "CIM_IPNetworkSecurityIndication.IPv4NumericDestAddress" , "CIM_IPNetworkSecurityIndication.IPVersionSupport" } string DestAddress ; The address for the destination of the network traffic associated with this Indication from the Detector's point of view. This address MUST be identical to the IPv4NumericDestAddress if both property values are not NULL and the IPVersionSupport property is 'IPv4'. | Values { "Unknown" , "DMTF Reserved" , "Degradation" , "Reconnaissance" , "Access" , "Integrity" , "System Compromised" , "Vendor Reserved" } Required ModelCorrespondence { "CIM_SecurityIndication.MoreSpecificEffects" } ValueMap { "0" , ".." , "2" , "3" , "4" , "5" , "6" , "16000.." } ArrayType ( "Indexed" ) uint16 Effects [ ] ; An array of enumerated values that describes the effect(s) of an event from the Detector's point of view. Some security devices such as simple packet filters may not be able to detect the notion of an event's Effect. In these cases, the Effect is 'Unknown'. Although in many cases the Effect of an attack is intended, not all attacks have a known intent, such as viruses or other malicious code, which may have multiple varied Effects. If there is more than one Effect, the first element in the array SHOULD represent the most significant or most severe Effect, from the Detector's point of view. The following values are defined: 0 - Unknown means the Effect of the event is purely unknown. 2 - Degradation. The message indicates that an attempt was made to damage or impair usability, performance, service availability, etc. 3 - Reconnaissance. The message indicates that there was an attempt to gather information useful for attacks, or probe for vulnerabilities without necessarily exploiting them. 4 - Access. The message indicates that access has been attempted or made to data or services. 5 - Integrity. The message indicates that there was an attempt to modify or delete data. 6 - System Compromised. The message indicates that an attacker succeeded in gaining complete access to the system. | Required Override ( "IndicationTime" ) ModelCorrespondence { "CIM_SecurityIndication.IndicationStartCountTime" } datetime IndicationTime ; The time and date of creation of the Indication. The property may be set to NULL if the entity creating the Indication is not capable of determining this information. Note that IndicationTime may be the same for two Indications that are generated in rapid succession. | MinValue ( 1 ) ModelCorrespondence { "CIM_SecurityIndication.IndicationStartCountTime" } Counter uint16 EventCount = 1 ; The number of events represented by this Indication. If IndicationStartCountTime is not NULL, EventCount MUST be greater than 1 which means that the Indication represents an event aggregate. | Required Override ( "IndicationIdentifier" ) MappingStrings { "Recommendation.ITU|X733.Notification " "identifier" } string IndicationIdentifier ; An identifier for the Indication. This property is similar to a key value in that it can be used for identification, when correlating Indications (see the CorrelatedIndications array). Its value SHOULD be unique as long as Alert correlations are reported, but MAY be reused or left NULL if no future Indications will reference it in their CorrelatedIndications array. | Values { "Unknown" , "DMTF Reserved" , "ArpPoisoning" , "Backdoor" , "Rootkit" , "Trojan" , "BufferOverflow" , "GuessPassword" , "ReplayAttack" , "SQLInjection" , "SpoofIdentity" , "PortSweep" , "HostSweep" , "NetworkSweep" , "NetworkICMP" , "NetworkTCP" , "NetworkUDP" , "Worm" , "Virus" , "Non-viral Malicious" , "Spyware" , "Adware" , "Login" , "Logout" , "Application Exploitation" , "Script Injection" , "Stale-data Scan" , "Congestion" , "Saturation" , "Overloading" , "Port Scan" , "Network Protocol" , "Network HTTP" , "Phishing" , "Redirection" , "RemoteExecution" , "DataManipulation" , "Cross-site Scripting" , "Vendor Reserved" } Required ModelCorrespondence { "CIM_SecurityIndication.MoreSpecificMechanisms" } ValueMap { "0" , ".." , "2" , "3" , "4" , "5" , "6" , "7" , "8" , "9" , "10" , "11" , "12" , "13" , "14" , "15" , "16" , "17" , "18" , "19" , "20" , "21" , "22" , "23" , "24" , "25" , "26" , "27" , "28" , "29" , "30" , "31" , "32" , "33" , "34" , "35" , "36" , "37" , "16000.." } ArrayType ( "Indexed" ) uint16 Mechanisms [ ] ; An array of integers indicating the method(s) used in an attack, probe, or other action. When more than one value is used there MAY be a parent/child or hierarchical relationship between values where the more general or parent value is at the lowest index and the more specific or child value(s) are at increasing indices. Values with a parent/child relationship are: Parent - NetworkProtocol Children - NetworkICMP, NetworkTCP, NetworkUDP, NetworkHTTP
Parent - Overloading Children - Congestion, Saturation Mechanisms values can be used with any of the Effects values, depending on the method(s) employed in an attack or probe. For example, a DoS attack using ICMP packets, Effects would contain Degradation, and Mechanisms would contain NetworkProtocol and NetworkICMP in that order. For a port scan, Effects contains Reconnaissance and Mechanisms would contain PortScan. | ModelCorrespondence { "CIM_SecurityIndication.Resources" , "CIM_AlertIndication.OwningEntity" } ArrayType ( "Indexed" ) string MoreSpecificResources [ ] ; Specifies a more specific resource based on a value specified in the Resources property. For example, if one of the values of Resources is Web, then a MoreSpecificResource might be Apache for an attack or probe against an Apache web server. String values for this property are vendor or Detector specific and as such, the property CIM_AlertIndication.OwningEntity SHOULD be populated to identify the business entity or standards body defining the possible values. | ModelCorrespondence { "CIM_SecurityIndication.Mechanisms" , "CIM_AlertIndication.OwningEntity" } ArrayType ( "Indexed" ) string MoreSpecificMechanisms [ ] ; Specifies a more specific mechanism based on a value specified in the Mechanisms property. For example, if one of the values of Mechanisms is Trojan, then a MoreSpecificMechanisms might be Connect for a trojan that opens a port and listens for connections. A different method might be Response if the trojan sends information. String values for this property are vendor or Detector specific and as such, the property CIM_AlertIndication.OwningEntity SHOULD be populated to identify the business entity or standards body defining the possible values. | Values { "Security Alert" } Required Override ( "AlertType" ) ValueMap { "8" } MappingStrings { "Recommendation.ITU|X733.Event type" } uint16 AlertType = 8 ; Primary classification of the Indication. The following value is the only value permitted from AlertIndication: 8 - Security Alert. An Indication of this type is associated with security violations, detection of viruses, and similar issues. | ModelCorrespondence { "CIM_SecurityIndication.Effects" , "CIM_AlertIndication.OwningEntity" } ArrayType ( "Indexed" ) string MoreSpecificEffects [ ] ; If more details are known about the effect of an attack or probe, this property can contain that information. For example, if one of the values of Effects is Access, a more specific Effect might be HostCompromised. Or, if the Effect is Degradation, a more specific effect might be DistributedDoS. String values for this property are vendor or Detector specific and as such, the property CIM_AlertIndication.OwningEntity SHOULD be populated to identify the business entity or standards body defining the possible values. | Values { "Unknown" , "DMTF Reserved" , "DB" , "DNS" , "FTP" , "Mail" , "Web" , "Host" , "Firewall" , "Registry" , "Network Device" , "Hardware" , "User Activity" , "Cookies" , "Network Data" , "Application Data" , "Application Configuration" , "OS Kernel" , "OS Configuration" , "OS Session" , "File System" , "Process" , "Service" , "Network Session" , "URL" , "User Account" , "Privileges" , "User Policy" , "Group" , "RPC" , "SNMP" , "Remote Service" , "Remote Share" , "Naming Service" , "Application" , "OS" , "NFS" , "SMB" , "CIFS" , "CPU" , "Router" , "Switch" , "LDAP" , "Vendor Reserved" } Required ModelCorrespondence { "CIM_SecurityIndication.MoreSpecificResources" } ValueMap { "0" , ".." , "2" , "3" , "4" , "5" , "6" , "7" , "8" , "9" , "10" , "11" , "12" , "13" , "14" , "15" , "16" , "17" , "18" , "19" , "20" , "21" , "22" , "23" , "24" , "25" , "26" , "27" , "28" , "29" , "30" , "31" , "32" , "33" , "34" , "35" , "36" , "37" , "38" , "39" , "40" , "41" , "42" , "16000.." } ArrayType ( "Indexed" ) uint16 Resources [ ] ; An integer indicating the type(s) of resource affected by an attack or probe. When more than one value is used there MAY be a parent/child or hierarchical relationship between values where the more general or parent value is at the lowest index and the more specific or child value(s) are at increasing indices. Values with a parent/child relationship are: Parent - Remote Service Children - Remote Share, Naming Service, DB, FTP, Mail, RPC, Web Parent - Remote Share Children - NFS, SMB, CIFS Parent - Naming Service Children - DNS, LDAP Parent - Application Children - Application Data, Application Configuration Parent - OS Children - OS Kernel, OS Configuration, OS Session, File System, Process, Service, User Account, Privileges, User Policy, Group, Registry, File Parent - Network Device Children - Firewall, Router, Switch For example, DB indicates that an attack was made against a database server, where Mail indicates that some type of email server is affected. DB, DNS, and other values can mean a server or service, e.g. there is no distinction between a DNS server resource and a DNS service resource. Web means a web server/service but more specific resources of this type can be specified using the MoreSpecificResources property, e.g. IIS, Apache, iPlanet, etc. | ModelCorrespondence { "CIM_SecurityIndication.EventCount" , "CIM_SecurityIndication.IndicationTime" } datetime IndicationStartCountTime ; The start time and date of a range of events represented by the Indication whose current event time is specified by IndicationTime. If the Indication represents a single event, this property MUST be set to NULL. If the Indication represents multiple events over time, the EventCount property MUST be greater than 1 and this property MUST be less than or equal to the IndicationTime value. In this case, the Indication represents an event aggregate with the aggregate amplitude being the EventCount property. The time range or EventCount does not imply a threshold in and of itself, but a time or amplitude threshold MAY be used in determining how a Detector populates this property. | Experimental ModelCorrespondence { "CIM_AlertIndication.MessageID" , "CIM_AlertIndication.MessageArguments" } string Message ; The formatted message. This message is constructed by applying the dynamic content of the message, described in MessageArguments, to the format string uniquely identified, within the scope of the OwningEntity, by MessageID. | MappingStrings { "Recommendation.ITU|X733.Additional text" } string Description ; A short description of the Indication. | Values { "Unknown" , "Other" , "Information" , "Degraded/Warning" , "Minor" , "Major" , "Critical" , "Fatal/NonRecoverable" } Required Override ( "PerceivedSeverity" ) ValueMap { "0" , "1" , "2" , "3" , "4" , "5" , "6" , "7" } MappingStrings { "Recommendation.ITU|X733.Perceived severity" } uint16 PerceivedSeverity ; An enumerated value that describes the severity of the Alert Indication from the notifier's point of view: 1 - Other, by CIM convention, is used to indicate that the Severity's value can be found in the OtherSeverity property. 3 - Degraded/Warning should be used when its appropriate to let the user decide if action is needed. 4 - Minor should be used to indicate action is needed, but the situation is not serious at this time. 5 - Major should be used to indicate action is needed NOW. 6 - Critical should be used to indicate action is needed NOW and the scope is broad (perhaps an imminent outage to a critical resource will result). 7 - Fatal/NonRecoverable should be used to indicate an error occurred, but it's too late to take remedial action. 2 and 0 - Information and Unknown (respectively) follow common usage. Literally, the AlertIndication is purely informational or its severity is simply unknown. | Values { "Unknown" , "Other" , "Adapter/Card Error" , "Application Subsystem Failure" , "Bandwidth Reduced" , "Connection Establishment Error" , "Communications Protocol Error" , "Communications Subsystem Failure" , "Configuration/Customization Error" , "Congestion" , "Corrupt Data" , "CPU Cycles Limit Exceeded" , "Dataset/Modem Error" , "Degraded Signal" , "DTE-DCE Interface Error" , "Enclosure Door Open" , "Equipment Malfunction" , "Excessive Vibration" , "File Format Error" , "Fire Detected" , "Flood Detected" , "Framing Error" , "HVAC Problem" , "Humidity Unacceptable" , "I/O Device Error" , "Input Device Error" , "LAN Error" , "Non-Toxic Leak Detected" , "Local Node Transmission Error" , "Loss of Frame" , "Loss of Signal" , "Material Supply Exhausted" , "Multiplexer Problem" , "Out of Memory" , "Output Device Error" , "Performance Degraded" , "Power Problem" , "Pressure Unacceptable" , "Processor Problem (Internal Machine Error)" , "Pump Failure" , "Queue Size Exceeded" , "Receive Failure" , "Receiver Failure" , "Remote Node Transmission Error" , "Resource at or Nearing Capacity" , "Response Time Excessive" , "Retransmission Rate Excessive" , "Software Error" , "Software Program Abnormally Terminated" , "Software Program Error (Incorrect Results)" , "Storage Capacity Problem" , "Temperature Unacceptable" , "Threshold Crossed" , "Timing Problem" , "Toxic Leak Detected" , "Transmit Failure" , "Transmitter Failure" , "Underlying Resource Unavailable" , "Version MisMatch" , "Previous Alert Cleared" , "Login Attempts Failed" , "Software Virus Detected" , "Hardware Security Breached" , "Denial of Service Detected" , "Security Credential MisMatch" , "Unauthorized Access" , "Alarm Received" , "Loss of Pointer" , "Payload Mismatch" , "Transmission Error" , "Excessive Error Rate" , "Trace Problem" , "Element Unavailable" , "Element Missing" , "Loss of Multi Frame" , "Broadcast Channel Failure" , "Invalid Message Received" , "Routing Failure" , "Backplane Failure" , "Identifier Duplication" , "Protection Path Failure" , "Sync Loss or Mismatch" , "Terminal Problem" , "Real Time Clock Failure" , "Antenna Failure" , "Battery Charging Failure" , "Disk Failure" , "Frequency Hopping Failure" , "Loss of Redundancy" , "Power Supply Failure" , "Signal Quality Problem" , "Battery Discharging" , "Battery Failure" , "Commercial Power Problem" , "Fan Failure" , "Engine Failure" , "Sensor Failure" , "Fuse Failure" , "Generator Failure" , "Low Battery" , "Low Fuel" , "Low Water" , "Explosive Gas" , "High Winds" , "Ice Buildup" , "Smoke" , "Memory Mismatch" , "Out of CPU Cycles" , "Software Environment Problem" , "Software Download Failure" , "Element Reinitialized" , "Timeout" , "Logging Problems" , "Leak Detected" , "Protection Mechanism Failure" , "Protecting Resource Failure" , "Database Inconsistency" , "Authentication Failure" , "Breach of Confidentiality" , "Cable Tamper" , "Delayed Information" , "Duplicate Information" , "Information Missing" , "Information Modification" , "Information Out of Sequence" , "Key Expired" , "Non-Repudiation Failure" , "Out of Hours Activity" , "Out of Service" , "Procedural Error" , "Unexpected Information" } Required ModelCorrespondence { "CIM_AlertIndication.ProbableCauseDescription" , "CIM_AlertIndication.EventID" , "CIM_AlertIndication.EventTime" } ValueMap { "0" , "1" , "2" , "3" , "4" , "5" , "6" , "7" , "8" , "9" , "10" , "11" , "12" , "13" , "14" , "15" , "16" , "17" , "18" , "19" , "20" , "21" , "22" , "23" , "24" , "25" , "26" , "27" , "28" , "29" , "30" , "31" , "32" , "33" , "34" , "35" , "36" , "37" , "38" , "39" , "40" , "41" , "42" , "43" , "44" , "45" , "46" , "47" , "48" , "49" , "50" , "51" , "52" , "53" , "54" , "55" , "56" , "57" , "58" , "59" , "60" , "61" , "62" , "63" , "64" , "65" , "66" , "67" , "68" , "69" , "70" , "71" , "72" , "73" , "74" , "75" , "76" , "77" , "78" , "79" , "80" , "81" , "82" , "83" , "84" , "85" , "86" , "87" , "88" , "89" , "90" , "91" , "92" , "93" , "94" , "95" , "96" , "97" , "98" , "99" , "100" , "101" , "102" , "103" , "104" , "105" , "106" , "107" , "108" , "109" , "110" , "111" , "112" , "113" , "114" , "115" , "116" , "117" , "118" , "119" , "120" , "121" , "122" , "123" , "124" , "125" , "126" , "127" , "128" , "129" , "130" } MappingStrings { "Recommendation.ITU|X733.Probable cause" , "Recommendation.ITU|M3100.probableCause" , "ITU-IANA-ALARM-TC" } uint16 ProbableCause ; An enumerated value that describes the probable cause of the situation which resulted in the AlertIndication. | ModelCorrespondence { "CIM_AlertIndication.AlertType" } string OtherAlertType ; A string describing the Alert type - used when the AlertType property is set to 1, 'Other State Change'. | Values { "Unknown" , "Not Applicable" , "Trending Up" , "Trending Down" , "No Change" } ValueMap { "0" , "1" , "2" , "3" , "4" } MappingStrings { "Recommendation.ITU|X733.TrendIndication" } uint16 Trending ; Provides information on trending - trending up, down or no change. | ModelCorrespondence { "CIM_AlertIndication.ProbableCause" } string ProbableCauseDescription ; Provides additional information related to the ProbableCause. | MappingStrings { "Recommendation.ITU|X733.Proposed repair " "actions" } string RecommendedActions [ ] ; Free form descriptions of the recommended actions to take to resolve the cause of the notification. | Values { "Unknown" , "Other" , "CIMObjectPath" } ModelCorrespondence { "CIM_AlertIndication.AlertingManagedElement" , "CIM_AlertIndication.OtherAlertingElementFormat" } ValueMap { "0" , "1" , "2" } uint16 AlertingElementFormat = 0 ; The format of the AlertingManagedElement property is interpretable based upon the value of this property. Values are defined as: 0 - Unknown. The format is unknown or not meaningfully interpretable by a CIM client application. 1 - Other. The format is defined by the value of the OtherAlertingElementFormat property. 2 - CIMObjectPath. The format is a CIMObjectPath, with format <NamespacePath>:<ClassName>.<Prop1>='<Value1>', <Prop2>='<Value2>', . . . specifying an instance in the CIM Schema. | ModelCorrespondence { "CIM_AlertIndication.AlertingElementFormat" } string AlertingManagedElement ; The identifying information of the entity (ie, the instance) for which this Indication is generated. The property contains the path of an instance, encoded as a string parameter - if the instance is modeled in the CIM Schema. If not a CIM instance, the property contains some identifying string that names the entity for which the Alert is generated. The path or identifying string is formatted per the AlertingElementFormat property. | ModelCorrespondence { "CIM_AlertIndication.AlertingElementFormat" } string OtherAlertingElementFormat ; A string defining 'Other' values for AlertingElementFormat. This value MUST be set to a non NULL value when AlertingElementFormat is set to a value of 1 ('Other'). For all other values of AlertingElementFormat, the value of this string must be set to NULL. | MaxLen ( 256 ) string SystemName ; The scoping System's Name for the Provider generating this Indication. | Experimental ModelCorrespondence { "CIM_AlertIndication.Message" , "CIM_AlertIndication.MessageID" } string MessageArguments [ ] ; An array containing the dynamic content of the message. | Experimental ModelCorrespondence { "CIM_AlertIndication.Message" , "CIM_AlertIndication.MessageArguments" } string MessageID ; A string that uniquely identifies, within the scope of the OwningEntity, the format of the Message. | ModelCorrespondence { "CIM_AlertIndication.ProbableCause" } datetime EventTime ; The time and date the underlying event was first detected. If specified, this property MUST be set to NULL if the creating entity is not capable of providing this information. This value is based on the notion of local date and time of the Managed System Element generating the Indication. | MaxLen ( 256 ) string ProviderName ; The name of the Provider generating this Indication. | Experimental string OwningEntity ; A string that uniquely identifies the entity that owns the definition of the format of the Message described in this instance. OwningEntity MUST include a copyrighted, trademarked or otherwise unique name that is owned by the business entity or standards body defining the format. | ModelCorrespondence { "CIM_AlertIndication.ProbableCause" } string EventID ; An instrumentation or provider specific value that describes the underlying 'real-world' event represented by the Indication. Two Indications with the same, non NULL EventID value are considered, by the creating entity, to represent the same event. The comparison of two EventID values is only defined for Alert Indications with identical, non NULL values of SystemCreateClassName, SystemName and ProviderName. | MaxLen ( 256 ) string SystemCreationClassName ; The scoping System's CreationClassName for the Provider generating this Indication. | ModelCorrespondence { "CIM_AlertIndication.PerceivedSeverity" } string OtherSeverity ; Holds the value of the user defined severity value when 'PerceivedSeverity' is 1 ('Other'). | MappingStrings { "Recommendation.ITU|X733.Correlated " "notifications" } string CorrelatedIndications [ ] ; A list of IndicationIdentifiers whose notifications are correlated with (related to) this one. |
| | | | |
|