The following is a description of the elements, types, and attributes that compose the Windows specific tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and should provide the information necessary to understand what each element and attribute represents. This document is intended for developers and assumes some familiarity with XML. A high level description of the interaction between the different tests and their relationship to the Core Definition Schema is not outlined here.
The OVAL Schema is maintained by The Mitre Corporation and developed by the public OVAL Community. For more information, including how to get involved in the project and how to submit change requests, please visit the OVAL website at http://oval.mitre.org.
The access token test is used to check the properties of a Windows' access token as well as individual privileges and rights associated with it. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an accesstoken_object and the optional state element specifies the data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The accesstoken_object element is used by an access token test to define the object to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An access token object consists of a single security principle that identifies user, group, or compter account that is associated with the token.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:AccesstokenBehaviors 0 security_principle oval-def:EntityObjectStringType
The accesstoken_state element defines the different information that can be used to evaluate the specified access tokens. This includes the multitude of user rights and permissions that can be granted. Please refer to the individual elements in the schema for more details about what each represents.
These behaviors allow a more detailed definition of the accesstoken_object being specified.
Attributes:
- include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The active directory test is used to check information about specific entries in active directory. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an activedirectory_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The activedirectory_object element is used by an active directory test to define those objects to evaluated based on a specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An active directory object consists of three pieces of information, a naming context, a relative distinguished name, and an attribute. Each piece helps identify a specific active directory entry.
Child Elements Type MinOccurs MaxOccurs naming_context win-def:EntityObjectNamingContextType relative_dn oval-def:EntityObjectStringType attribute oval-def:EntityObjectStringType
The activedirectory_state element defines the different information that can be used to evaluate the specified entries in active directory. An active directory test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs naming_context win-def:EntityStateNamingContextType 0 relative_dn oval-def:EntityStateStringType 0 attribute oval-def:EntityStateStringType 0 object_class oval-def:EntityStateStringType 0 adstype win-def:EntityStateAdstypeType 0 value oval-def:EntityStateAnyType 0 unbounded
The audit event policy test is used to check different types of events the system should audit. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The auditeventpolicy_object element is used by an audit event policy test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy will reference the same auditeventpolicy_object which is basically an empty object element.
The auditeventpolicy_state element specifies the different system activities that can be audited. An audit event policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. The defined values are found in window's POLICY_AUDIT_EVENT_TYPE enumeration and accessed through the LsaQueryInformationPolicy when the InformationClass parameters are set to PolicyAuditEventsInformation. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs account_logon win-def:EntityStateAuditType 0 account_management win-def:EntityStateAuditType 0 detailed_tracking win-def:EntityStateAuditType 0 directory_service_access win-def:EntityStateAuditType 0 logon win-def:EntityStateAuditType 0 object_access win-def:EntityStateAuditType 0 policy_change win-def:EntityStateAuditType 0 privilege_use win-def:EntityStateAuditType 0 system win-def:EntityStateAuditType 0
The audit event policy subcategories test is used to check different types of events the system should audit. These subcategories are new for Windows Vista. The test extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a auditeventpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The auditeventpolicysubcategories_object element is used by an audit event policy subcategories test to define those objects to evaluate based on a specified state. There is actually only one object relating to audit event policy subcategories and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check audit event policy subcategories will reference the same auditeventpolicysubcategories_object which is basically an empty object element.
The auditeventpolicysubcategories_state element specifies the different system activities that can be audited. An audit event policy subcategories test will reference a specific instance of this state that defines the exact subcategories that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs credential_validation win-def:EntityStateAuditType 0 kerberos_ticket_events win-def:EntityStateAuditType 0 other_account_logon_events win-def:EntityStateAuditType 0 application_group_management win-def:EntityStateAuditType 0 computer_account_management win-def:EntityStateAuditType 0 distribution_group_management win-def:EntityStateAuditType 0 other_account_management_events win-def:EntityStateAuditType 0 security_group_management win-def:EntityStateAuditType 0 user_account_management win-def:EntityStateAuditType 0 dpapi_activity win-def:EntityStateAuditType 0 process_creation win-def:EntityStateAuditType 0 process_termination win-def:EntityStateAuditType 0 rpc_events win-def:EntityStateAuditType 0 directory_service_access win-def:EntityStateAuditType 0 directory_service_changes win-def:EntityStateAuditType 0 directory_service_replication win-def:EntityStateAuditType 0 detailed_directory_service_replication win-def:EntityStateAuditType 0 account_lockout win-def:EntityStateAuditType 0 ipsec_extended_mode win-def:EntityStateAuditType 0 ipsec_main_mode win-def:EntityStateAuditType 0 ipsec_quick_mode win-def:EntityStateAuditType 0 logoff win-def:EntityStateAuditType 0 logon win-def:EntityStateAuditType 0 other_logon_logoff_events win-def:EntityStateAuditType 0 special_logon win-def:EntityStateAuditType 0 application_generated win-def:EntityStateAuditType 0 certification_services win-def:EntityStateAuditType 0 file_share win-def:EntityStateAuditType 0 file_system win-def:EntityStateAuditType 0 filtering_platform_connection win-def:EntityStateAuditType 0 filtering_platform_packet_drop win-def:EntityStateAuditType 0 handle_manipulation win-def:EntityStateAuditType 0 kernel_object win-def:EntityStateAuditType 0 other_object_access_events win-def:EntityStateAuditType 0 registry win-def:EntityStateAuditType 0 sam win-def:EntityStateAuditType 0 audit_policy_change win-def:EntityStateAuditType 0 authentication_policy_change win-def:EntityStateAuditType 0 authorization_policy_change win-def:EntityStateAuditType 0 filtering_platform_policy_change win-def:EntityStateAuditType 0 mpssvc_rule_level_policy_change win-def:EntityStateAuditType 0 other_policy_change_events win-def:EntityStateAuditType 0 non_sensitive_privilege_use win-def:EntityStateAuditType 0 other_privilege_use_events win-def:EntityStateAuditType 0 sensitive_privilege_use win-def:EntityStateAuditType 0 ipsec_driver win-def:EntityStateAuditType 0 other_system_events win-def:EntityStateAuditType 0 security_state_change win-def:EntityStateAuditType 0 security_system_extension win-def:EntityStateAuditType 0 system_integrity win-def:EntityStateAuditType 0
The file test is used to check metadata associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a file_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The file_object element is used by a file test to define the specific file(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A file object defines the path and filename of the file(s). In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileBehaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileBehaviors 0 path oval-def:EntityObjectStringType filename oval-def:EntityObjectStringType
The file_state element defines the different metadata associate with a Windows file. This includes the path, filename, owner, size, last modified time, version, etc. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs path oval-def:EntityStateStringType 0 filename oval-def:EntityStateStringType 0 owner oval-def:EntityStateStringType 0 size oval-def:EntityStateIntType 0 a_time oval-def:EntityStateIntType 0 c_time oval-def:EntityStateIntType 0 m_time oval-def:EntityStateIntType 0 ms_checksum oval-def:EntityStateStringType 0 version oval-def:EntityStateStringType 0 type win-def:EntityStateFileTypeType 0 development_class oval-def:EntityStateStringType 0 company oval-def:EntityStateStringType 0 internal_name oval-def:EntityStateStringType 0 language oval-def:EntityStateStringType 0 original_filename oval-def:EntityStateStringType 0 product_name oval-def:EntityStateStringType 0 product_version oval-def:EntityStateStringType 0
The FileBehaviors complex type defines a number of behaviors that allow a more detailed definition of the file objects being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none')
The file audit permissions test is used to check the audit permissions associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The fileauditedpermissions53_object element is used by a file audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A fileauditedpermissions53_object is defined as a combination of a Windows file and trustee sid. The file represents the file to be evaluated while the trustee sid represents the account (sid) to check audited permissions of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileAuditPermissions53Behaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileAuditPermissions53Behaviors 0 path oval-def:EntityObjectStringType filename oval-def:EntityObjectStringType trustee_sid oval-def:EntityObjectStringType
The fileauditedpermissions53_state element defines the different audit permissions that can be associated with a given fileauditedpermissions53_object. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs path oval-def:EntityStateStringType 0 filename oval-def:EntityStateStringType 0 trustee_sid oval-def:EntityStateStringType 0 standard_delete win-def:EntityStateAuditType 0 standard_read_control win-def:EntityStateAuditType 0 standard_write_dac win-def:EntityStateAuditType 0 standard_write_owner win-def:EntityStateAuditType 0 standard_synchronize win-def:EntityStateAuditType 0 access_system_security win-def:EntityStateAuditType 0 generic_read win-def:EntityStateAuditType 0 generic_write win-def:EntityStateAuditType 0 generic_execute win-def:EntityStateAuditType 0 generic_all win-def:EntityStateAuditType 0 file_read_data win-def:EntityStateAuditType 0 file_write_data win-def:EntityStateAuditType 0 file_append_data win-def:EntityStateAuditType 0 file_read_ea win-def:EntityStateAuditType 0 file_write_ea win-def:EntityStateAuditType 0 file_execute win-def:EntityStateAuditType 0 file_delete_child win-def:EntityStateAuditType 0 file_read_attributes win-def:EntityStateAuditType 0 file_write_attributes win-def:EntityStateAuditType 0
These behaviors allow a more detailed definition of the fileauditpermissions53_objects being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
This test has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer fileauditedpermissions53_test.
The file audit permissions test is used to check the audit permissions associated with Windows files. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
This object has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer fileauditedpermissions53_object.
The fileauditedpermissions_object element is used by a file audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A fileauditedpermissions_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileAuditPermissionsBehaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileAuditPermissionsBehaviors 0 path oval-def:EntityObjectStringType filename oval-def:EntityObjectStringType trustee_name oval-def:EntityObjectStringType
This state has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer fileauditedpermissions53_state.
The fileauditedpermissions_state element defines the different audit permissions that can be associated with a given fileauditedpermissions_object. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs path oval-def:EntityStateStringType 0 filename oval-def:EntityStateStringType 0 trustee_name oval-def:EntityStateStringType 0 standard_delete win-def:EntityStateAuditType 0 standard_read_control win-def:EntityStateAuditType 0 standard_write_dac win-def:EntityStateAuditType 0 standard_write_owner win-def:EntityStateAuditType 0 standard_synchronize win-def:EntityStateAuditType 0 access_system_security win-def:EntityStateAuditType 0 generic_read win-def:EntityStateAuditType 0 generic_write win-def:EntityStateAuditType 0 generic_execute win-def:EntityStateAuditType 0 generic_all win-def:EntityStateAuditType 0 file_read_data win-def:EntityStateAuditType 0 file_write_data win-def:EntityStateAuditType 0 file_append_data win-def:EntityStateAuditType 0 file_read_ea win-def:EntityStateAuditType 0 file_write_ea win-def:EntityStateAuditType 0 file_execute win-def:EntityStateAuditType 0 file_delete_child win-def:EntityStateAuditType 0 file_read_attributes win-def:EntityStateAuditType 0 file_write_attributes win-def:EntityStateAuditType 0
These behaviors allow a more detailed definition of the fileauditpermissions_objects being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The file effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The fileeffectiverights53_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileeffectiverights53_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The fileeffectiverights53_object element is used by a file effective rights test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A fileeffectiverights53_object is defined as a combination of a Windows file and trustee sid. The file represents the file to be evaluated while the trustee sid represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileEffectiveRights53Behaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileEffectiveRights53Behaviors 0 path oval-def:EntityObjectStringType filename oval-def:EntityObjectStringType trustee_sid oval-def:EntityObjectStringType
The fileeffectiverights53_state element defines the different rights that can be associated with a given fileeffectiverights53_object. Please refer to the individual elements in the schema for more details about what each represents.
These behaviors allow a more detailed definition of the fileeffectiverights53_objects being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
This test has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer fileeffectiverights53_test.
The file effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The fileeffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a fileeffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
This object has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer fileeffectiverights53_object.
The fileeffectiverights_object element is used by a file effective rights test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A fileeffectiverights_object is defined as a combination of a Windows file and trustee name. The file represents the file to be evaluated while the trustee name represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileEffectiveRightsBehaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:FileEffectiveRightsBehaviors 0 path oval-def:EntityObjectStringType filename oval-def:EntityObjectStringType trustee_name oval-def:EntityObjectStringType
This state has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer fileeffectiverights53_state.
The fileeffectiverights_state element defines the different rights that can be associated with a given fileeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents.
These behaviors allow a more detailed definition of the fileeffectiverights_objects being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The group_test allows the different users that belong to specific groups (identified by name) to be tested. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a group_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The group_object element is used by a group test to define the specific group(s) (identified by name) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs group oval-def:EntityObjectStringType
The group_state element enumerates the different users associate with a Windows group. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs group oval-def:EntityStateStringType 0 user oval-def:EntityStateStringType 0
The group_sid_test allows the different users that belong to specific groups (identified by SID) to be tested. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a group_sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The group_sid_object element is used by a group_test to define the specific group(s) (identified by SID) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs group_sid oval-def:EntityObjectStringType
The group_state element enumerates the different users associated with a Windows group. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs group_sid oval-def:EntityStateStringType 0 user_sid oval-def:EntityStateStringType 0
The interface test enumerate various attributes about the interfaces on a system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references an interface_object and the optional state element specifies the interface information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The interface_object element is used by an interface test to define the specific interfaces(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An interface object consists of a single name entity that identifies which interface is being specified. For help understanding this object, see the MIB_IFROW and MIB_IPADDRROW structures.
Child Elements Type MinOccurs MaxOccurs name oval-def:EntityObjectStringType
The interface_state element enumerates the different properties associate with a Windows interface. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs name oval-def:EntityStateStringType 0 index oval-def:EntityStateIntType 0 type win-def:EntityStateInterfaceTypeType 0 hardware_addr oval-def:EntityStateStringType 0 inet_addr oval-def:EntityStateStringType 0 broadcast_addr oval-def:EntityStateStringType 0 netmask oval-def:EntityStateStringType 0 addr_type win-def:EntityStateAddrTypeType 0
The lockout policy test enumerates various attributes associated with lockout information for users and global groups in the security database. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a lockoutpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The lockoutpolicy_object element is used by a lockout policy test to define those objects to evaluated based on a specified state. There is actually only one object relating to lockout policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check lockout policy will reference the same lockoutpolicy_object which is basically an empty object element.
The lockoutpolicy_state element specifies the various attributes associated with lockout information for users and global groups in the security database. A lockout policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs force_logoff oval-def:EntityStateIntType 0 lockout_duration oval-def:EntityStateIntType 0 lockout_observation_window oval-def:EntityStateIntType 0 lockout_threshold oval-def:EntityStateIntType 0
The metabase test is used to check information found in the Windows metabase. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a metabase_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The metabase_object element is used by a metabase test to define the specific metabase item(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A metabase object defines the key and id of the item(s).
Child Elements Type MinOccurs MaxOccurs key oval-def:EntityObjectStringType id oval-def:EntityObjectIntType
The metabase_state element defines the different metadata associate with a metabase item. This includes the name, user type, data type, and the actual data. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs key oval-def:EntityStateStringType 0 id oval-def:EntityStateIntType 0 name oval-def:EntityStateStringType 0 user_type oval-def:EntityStateStringType 0 data_type oval-def:EntityStateStringType 0 data oval-def:EntityStateAnyType 0
The password policy test is used to check specific policy associated with passwords. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a passwordpolicy_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
NOTE: This information is stored in the SAM or Active Directory but is encrypted or hidden so the registry_test and activedirectory_test are of no use. If this can be figured out, then the password_policy test is not needed.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The passwordpolicy_object element is used by a password policy test to define those objects to evaluated based on a specified state. There is actually only one object relating to password policy and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check password policy will reference the same passwordpolicy_object which is basically an empty object element.
The passwordpolicy_state element specifies the various policies associated with passwords. A password policy test will reference a specific instance of this state that defines the exact settings that need to be evaluated.
Child Elements Type MinOccurs MaxOccurs max_passwd_age oval-def:EntityStateIntType 0 min_passwd_age oval-def:EntityStateIntType 0 min_passwd_len oval-def:EntityStateIntType 0 password_hist_len oval-def:EntityStateIntType 0 password_complexity oval-def:EntityStateBoolType 0 reversible_encryption oval-def:EntityStateBoolType 0
The port test is used to check information about the available ports on a Windows system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a port_object and the optional state element specifies the port information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The port_object element is used by a port test to define the specific port(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A port object defines the local address, port number, and protocol of the port(s).
Child Elements Type MinOccurs MaxOccurs local_address oval-def:EntityObjectStringType local_port oval-def:EntityObjectIntType protocol win-def:EntityObjectProtocolType
The port_state element defines the different metadata associate with a Windows port. This includes the local address, port number, protocol, and pid. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs local_address oval-def:EntityStateStringType 0 local_port oval-def:EntityStateIntType 0 protocol win-def:EntityStateProtocolType 0 pid oval-def:EntityStateIntType 0
The printer effective rights test is used to check the effective rights associated with Windows printers. The printereffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a printereffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
Child Elements Type MinOccurs MaxOccurs behaviors win-def:PrinterEffectiveRightsBehaviors 0 printer_name oval-def:EntityObjectStringType trustee_sid oval-def:EntityObjectStringType
The regkeyeffectiverights_state element defines the different rights that can be associated with a given regkeyeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs printer_name oval-def:EntityStateStringType 0 trustee_sid oval-def:EntityStateStringType 0 standard_delete oval-def:EntityStateBoolType 0 standard_read_control oval-def:EntityStateBoolType 0 standard_write_dac oval-def:EntityStateBoolType 0 standard_write_owner oval-def:EntityStateBoolType 0 standard_synchronize oval-def:EntityStateBoolType 0 access_system_security oval-def:EntityStateBoolType 0 generic_read oval-def:EntityStateBoolType 0 generic_write oval-def:EntityStateBoolType 0 generic_execute oval-def:EntityStateBoolType 0 generic_all oval-def:EntityStateBoolType 0 printer_access_administer oval-def:EntityStateBoolType 0 printer_access_use oval-def:EntityStateBoolType 0 job_access_administer oval-def:EntityStateBoolType 0 job_access_read oval-def:EntityStateBoolType 0
The PrinterEffectiveRightsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the pritnereffectiverights objects being specified.
Attributes:
- include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The process test is used to check information found in the Windows processes. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a process_object and the optional state element specifies the process information to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The process_object element is used by a process test to define the specific process(es) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A process object defines the command line used to start the process(s).
Child Elements Type MinOccurs MaxOccurs command_line oval-def:EntityObjectStringType
The process_state element defines the different metadata associate with a Windows process. This includes the command line, pid, ppid, image path, and current directory. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs command_line oval-def:EntityStateStringType 0 pid oval-def:EntityStateIntType 0 ppid oval-def:EntityStateIntType 0 priority oval-def:EntityStateStringType 0 image_path oval-def:EntityStateStringType 0 current_dir oval-def:EntityStateStringType 0
The registry test is used to check metadata associated with Windows registry key. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a registry_object and the optional state element specifies the registry data to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegistryBehaviors 0 hive win-def:EntityObjectRegistryHiveType key oval-def:EntityObjectStringType name oval-def:EntityObjectStringType
The registry_state element defines the different metadata associate with a Windows registry key. This includes the hive, key, name, type, and value. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs hive win-def:EntityStateRegistryHiveType 0 key oval-def:EntityStateStringType 0 name oval-def:EntityStateStringType 0 type win-def:EntityStateRegistryTypeType 0 value oval-def:EntityStateAnyType 0
The RegistryBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registry objects being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none')
The registry key audited permissions test is used to check the audit permissions associated with Windows registry keys. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyauditedpermissions53_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The regkeyauditedpermissions53_object element is used by a registry key audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A regkeyauditedpermissions53_object is defined as a combination of a Windows registry key and trustee name. The hive and key elements represents the registry key to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple keys or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the RegkeyAuditPermissions53Behaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegkeyAuditPermissions53Behaviors 0 hive win-def:EntityObjectRegistryHiveType key oval-def:EntityObjectStringType trustee_sid oval-def:EntityObjectStringType
The regkeyauditedpermissions53_state element defines the different audit permissions that can be associated with a given regkeyauditedpermissions53_object. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs hive win-def:EntityStateRegistryHiveType 0 key oval-def:EntityStateStringType 0 trustee_sid oval-def:EntityStateStringType 0 standard_delete win-def:EntityStateAuditType 0 standard_read_control win-def:EntityStateAuditType 0 standard_write_dac win-def:EntityStateAuditType 0 standard_write_owner win-def:EntityStateAuditType 0 standard_synchronize win-def:EntityStateAuditType 0 access_system_security win-def:EntityStateAuditType 0 generic_read win-def:EntityStateAuditType 0 generic_write win-def:EntityStateAuditType 0 generic_execute win-def:EntityStateAuditType 0 generic_all win-def:EntityStateAuditType 0 key_query_value win-def:EntityStateAuditType 0 key_set_value win-def:EntityStateAuditType 0 key_create_sub_key win-def:EntityStateAuditType 0 key_enumerate_sub_keys win-def:EntityStateAuditType 0 key_notify win-def:EntityStateAuditType 0 key_create_link win-def:EntityStateAuditType 0 key_wow64_64key win-def:EntityStateAuditType 0 key_wow64_32key win-def:EntityStateAuditType 0 key_wow64_res win-def:EntityStateAuditType 0
The RegkeyAuditPermissions53Behaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyauditedpermissions53_object being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
This test has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer regkeyauditedpermissions53_test.
The registry key audited permissions test is used to check the audit permissions associated with Windows registry keys. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyauditedpermissions_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
This object has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer regkeyauditedpermissions53_object.
The regkeyauditedpermissions_object element is used by a registry key audited permissions test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A regkeyauditedpermissions_object is defined as a combination of a Windows registry key and trustee name. The hive and key elements represents the registry key to be evaluated while the trustee name represents the account (sid) to check audited permissions of. If multiple keys or sids are matched by either reference, then each possible combination of file and sid is a matching file audited permissions object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the RegkeyAuditPermissionsBehaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegkeyAuditPermissionsBehaviors 0 hive win-def:EntityObjectRegistryHiveType key oval-def:EntityObjectStringType trustee_name oval-def:EntityObjectStringType
This state has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer regkeyauditedpermissions53_state.
The regkeyauditedpermissions_state element defines the different audit permissions that can be associated with a given regkeyauditedpermissions_object. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs hive win-def:EntityStateRegistryHiveType 0 key oval-def:EntityStateStringType 0 trustee_name oval-def:EntityStateStringType 0 standard_delete win-def:EntityStateAuditType 0 standard_read_control win-def:EntityStateAuditType 0 standard_write_dac win-def:EntityStateAuditType 0 standard_write_owner win-def:EntityStateAuditType 0 standard_synchronize win-def:EntityStateAuditType 0 access_system_security win-def:EntityStateAuditType 0 generic_read win-def:EntityStateAuditType 0 generic_write win-def:EntityStateAuditType 0 generic_execute win-def:EntityStateAuditType 0 generic_all win-def:EntityStateAuditType 0 key_query_value win-def:EntityStateAuditType 0 key_set_value win-def:EntityStateAuditType 0 key_create_sub_key win-def:EntityStateAuditType 0 key_enumerate_sub_keys win-def:EntityStateAuditType 0 key_notify win-def:EntityStateAuditType 0 key_create_link win-def:EntityStateAuditType 0 key_wow64_64key win-def:EntityStateAuditType 0 key_wow64_32key win-def:EntityStateAuditType 0 key_wow64_res win-def:EntityStateAuditType 0
The RegkeyAuditPermissionsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyauditedpermissions objects being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The registry key effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The regkeyeffectiverights53_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyeffectiverights53_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The regkeyeffectiverights53_object element is used by a registry key effective rights test to define the objects used to evalutate against the specified state. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic.
A regkeyeffectiverights53_object is defined as a combination of a Windows registry and trustee sid. The key entity represents the registry key to be evaluated while the trustee sid represents the account (sid) to check effective rights of. If multiple files or sids are matched by either reference, then each possible combination of file and sid is a matching file effective rights object. In addition, a number of behaviors may be provided that help guide the collection of objects. Please refer to the FileEffectiveRights53Behaviors complex type for more information about specific behaviors.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegkeyEffectiveRights53Behaviors 0 hive win-def:EntityObjectRegistryHiveType key oval-def:EntityObjectStringType trustee_sid oval-def:EntityObjectStringType
The regkeyeffectiverights53_state element defines the different rights that can be associated with a given regkeyeffectiverights53_object. Please refer to the individual elements in the schema for more details about what each represents.
The RegkeyEffectiveRights53Behaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyeffectiverights53_object being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
This test has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer regkeyeffectiverights53_test.
The registry key effective rights test is used to check the effective rights associated with Windows files. Note that the trustee's effective access rights are the access rights that the ACL grants to the trustee or to any groups of which the trustee is a member. The regkeyeffectiverights_test element extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a regkeyeffectiverights_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
This object has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer regkeyeffectiverights53_object.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:RegkeyEffectiveRightsBehaviors 0 hive win-def:EntityObjectRegistryHiveType key oval-def:EntityObjectStringType trustee_name oval-def:EntityObjectStringType
This state has been deprecated and will be removed in version 6.0 of the language. Recommend use of the newer regkeyeffectiverights53_state.
The regkeyeffectiverights_state element defines the different rights that can be associated with a given regkeyeffectiverights_object. Please refer to the individual elements in the schema for more details about what each represents.
The RegkeyEffectiveRightsBehaviors complex type defines a number of behaviors that allow a more detailed definition of the registrykeyeffectiverights objects being specified.
Attributes:
- max_depth n/a (optional -- default='-1') - recurse_direction n/a (optional -- default='none') - include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The shared resource test is used to check properties associated with any shared resource on the system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The sharedresource_object element is used by a shared resource test to define the object, in this case a shared resource, to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
An shared resource object consists of a single netname entity that identifies a specific shared resource.
Child Elements Type MinOccurs MaxOccurs netname oval-def:EntityObjectStringType
The sharedresource_state element defines the different metadata associate with a Windows shared resource. This includes the share type, permissions, and max uses. This state mirror the SHARE_INFO_2 structure. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs netname oval-def:EntityStateStringType 0 shared_type win-def:EntityStateSharedResourceTypeType 0 max_uses oval-def:EntityStateIntType 0 current_uses oval-def:EntityStateIntType 0 local_path oval-def:EntityStateStringType 0 access_read_permission oval-def:EntityStateBoolType 0 access_write_permission oval-def:EntityStateBoolType 0 access_create_permission oval-def:EntityStateBoolType 0 access_exec_permission oval-def:EntityStateBoolType 0 access_delete_permission oval-def:EntityStateBoolType 0 access_atrib_permission oval-def:EntityStateBoolType 0 access_perm_permission oval-def:EntityStateBoolType 0 access_all_permission oval-def:EntityStateBoolType 0
The sid test is used to check properties associated with the specified sid. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The sid_object element is used by a sid_test to define the object set, in this case a set of sids (identified by name), to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:SidBehaviors 0 trustee_name oval-def:EntityObjectStringType
The sid_state element defines the different metadata associate with a Windows trustee (identified by name). Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs trustee_name oval-def:EntityStateStringType 0 trustee_sid oval-def:EntityStateStringType 0 trustee_domain oval-def:EntityStateStringType 0
The SidBehaviors complex type defines a number of behaviors that allow a more detailed definition of the sid objects being specified.
Attributes:
- include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The sid_sid_test is used to check properties associated with the specified sid. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a sid_sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Note that this sid_sid test was added in version 5.4 as a temporary fix. There is a need within the community to identify things like users and groups by both the name and the sid. For version 6 of OVAL, work is underway for a better solution to the problem, but for now, a second test was added to satisfy the need.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The sid_sid_object element is used by a sid_sid_test to define the object set, in this case a set of sids, to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
Child Elements Type MinOccurs MaxOccurs behaviors win-def:SidSidBehaviors 0 trustee_sid oval-def:EntityObjectStringType
The sid_state element defines the different metadata associate with a Windows trustee (identified by SID). Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs trustee_sid oval-def:EntityStateStringType 0 trustee_name oval-def:EntityStateStringType 0 trustee_domain oval-def:EntityStateStringType 0
The SidSidBehaviors complex type defines a number of behaviors that allow a more detailed definition of the sid objects being specified.
Attributes:
- include_group xsd:boolean (optional -- default='true') - resolve_group xsd:boolean (optional -- default='false')
The user access control test is used to check setting related to User Access Control within Windows. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a uaac_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The uac_object element is used by a user access control test to define those objects to evaluate based on a specified state. There is actually only one object relating to user access control and this is the system as a whole. Therefore, there are no child entities defined. Any OVAL Test written to check user access control settings will reference the same uac_object which is basically an empty object element.
The uac_state element specifies the different settings that are available under User Access Control. A user access control test will reference a specific instance of this state that defines the exact settings that need to be evaluated. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs admin_approval_mode oval-def:EntityStateBoolType 0 elevation_prompt_admin oval-def:EntityStateStringType 0 elevation_prompt_standard oval-def:EntityStateStringType 0 detect_installations oval-def:EntityStateBoolType 0 elevate_signed_executables oval-def:EntityStateBoolType 0 elevate_uiaccess oval-def:EntityStateBoolType 0 run_admins_aam oval-def:EntityStateBoolType 0 secure_desktop oval-def:EntityStateBoolType 0 virtualize_write_failures oval-def:EntityStateBoolType 0
The user test is used to check information about Windows users. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a user_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
Child Elements Type MinOccurs MaxOccurs user oval-def:EntityObjectStringType
The user_state element enumerates the different groups (identified by name) that a Windows user might belong to. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs user oval-def:EntityStateStringType 0 enabled oval-def:EntityStateBoolType 0 group oval-def:EntityStateStringType 0
The user_sid_test is used to check information about Windows users. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a user_sid_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The user_sid_object represents a set of users on a Windows system. This set (which might contain only one user) is identified by a SID.
Child Elements Type MinOccurs MaxOccurs user oval-def:EntityObjectStringType
The user_sid_state element enumerates the different groups (identified by SID) that a Windows user might belong to. Please refer to the individual elements in the schema for more details about what each represents.
Child Elements Type MinOccurs MaxOccurs user oval-def:EntityStateStringType 0 enabled oval-def:EntityStateBoolType 0 group oval-def:EntityStateStringType 0
The volume test is used to check information about different storage volumes found on a Windows system. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a volume_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
The volume_object element is used by a volume test to define the specific volume(s) to be evaluated. Each object extends the standard ObjectType as definied in the oval-definitions-schema and one should refer to the ObjectType description for more information. The common set element allows complex objects to be created using filters and set logic. Again, please refer to the description of the set element in the oval-definitions-schema.
A volume object defines the rootpath of the volume(s).
Child Elements Type MinOccurs MaxOccurs rootpath oval-def:EntityObjectStringType
The volume_state element defines the different metadata associate with a storage volume in Windows. This includes the rootpat, the file system type, name, and serial number, as well as any associated flags. Please refer to the individual elements in the schema for more details about what each represents. The GetVolumeInformation function as defined by Microsoft is also a good place to look for information.
The wmi test is used to check information accessed by WMI. It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType description for more information. The required object element references a wmi_object and the optional state element specifies the metadata to check. The evaluation of the test is guided by the check attribute that is inherited from the TestType.
Child Elements Type MinOccurs MaxOccurs object oval-def:ObjectRefType state oval-def:StateRefType 0
Child Elements Type MinOccurs MaxOccurs namespace oval-def:EntityObjectStringType wql oval-def:EntityObjectStringType
Child Elements Type MinOccurs MaxOccurs namespace oval-def:EntityStateStringType 0 wql oval-def:EntityStateStringType 0 result oval-def:EntityStateAnyType 0
The EntityStateAddrTypeType complex type restricts a string value to a specific set of values that describe address types associated with an interface. The empty string is also allowed to support empty emlement associated with variable references.
Value Description MIB_IPADDR_DELETED The address is being deleted.
MIB_IPADDR_DISCONNECTED The address is on disconnected interface.
MIB_IPADDR_DYNAMIC The stated address is a dynamic IP address.
MIB_IPADDR_PRIMARY The stated address is a primary IP address.
MIB_IPADDR_TRANSIENT The stated address is a transient address.
The EntityStateAdstypeType complex type restricts a string value to a specific set of values that specify the different types of information that an active directory attribute can represents. For more information look at the ADSTYPEENUM enumeration defined by Microsoft. The empty string is also allowed to support empty emlement associated with variable references.
Value Description ADSTYPE_INVALID The data type is invalid.
ADSTYPE_DN_STRING The string is of Distinguished Name (path) of a directory service object.
ADSTYPE_CASE_EXACT_STRING The string is of the case-sensitive type.
ADSTYPE_CASE_IGNORE_STRING The string is of the case-insensitive type.
ADSTYPE_PRINTABLE_STRING The string is displayable on screen or in print.
ADSTYPE_NUMERIC_STRING The string is of a numeral to be interpreted as text.
ADSTYPE_BOOLEAN The data is of a Boolean value.
ADSTYPE_INTEGER The data is of an integer value.
ADSTYPE_OCTET_STRING The string is of a byte array.
ADSTYPE_UTC_TIME The data is of the universal time as expressed in Universal Time Coordinate (UTC).
ADSTYPE_LARGE_INTEGER The data is of a long integer value.
ADSTYPE_PROV_SPECIFIC The string is of a provider-specific string.
ADSTYPE_OBJECT_CLASS Not used.
ADSTYPE_CASEIGNORE_LIST The data is of a list of case insensitive strings.
ADSTYPE_OCTET_LIST The data is of a list of octet strings.
ADSTYPE_PATH The string is of a directory path.
ADSTYPE_POSTALADDRESS The string is of the postal address type.
ADSTYPE_TIMESTAMP The data is of a time stamp in seconds.
ADSTYPE_BACKLINK The string is of a back link.
ADSTYPE_TYPEDNAME The string is of a typed name.
ADSTYPE_HOLD The data is of the Hold data structure.
ADSTYPE_NETADDRESS The string is of a net address.
ADSTYPE_REPLICAPOINTER The data is of a replica pointer.
ADSTYPE_FAXNUMBER The string is of a fax number.
ADSTYPE_EMAIL The data is of an e-mail message.
ADSTYPE_NT_SECURITY_DESCRIPTOR The data is of Windows NT/Windows 2000 security descriptor as represented by a byte array.
ADSTYPE_UNKNOWN The data is of an undefined type.
ADSTYPE_DN_WITH_BINARY The data is of ADS_DN_WITH_BINARY used for mapping a distinguished name to a non varying GUID.
ADSTYPE_DN_WITH_STRING The data is of ADS_DN_WITH_STRING used for mapping a distinguished name to a non-varying string value.
The EntityStateAuditType complex type restricts a string value to a specific set of values: AUDIT_NONE, AUDIT_SUCCESS, AUDIT_FAILURE, and AUDIT_SUCCESS_FAILURE. These values describe which audit records should be generated. The empty string is also allowed to support empty emlement associated with variable references.
Value Description AUDIT_FAILURE AUDIT_NONE AUDIT_SUCCESS AUDIT_SUCCESS_FAILURE
The EntityStateInterfaceTypeType complex type restricts a string value to a specific set of values. These values describe the different interface types. The empty string is also allowed to support empty emlement associated with variable references.
Value Description MIB_IF_TYPE_ETHERNET MIB_IF_TYPE_FDDI MIB_IF_TYPE_LOOPBACK MIB_IF_TYPE_OTHER MIB_IF_TYPE_PPP MIB_IF_TYPE_SLIP MIB_IF_TYPE_TOKENRING
The EntityStateFileTypeType complex type restricts a string value to a specific set of values. These values describe the type of file being represented. For more information see the GetFileType and GetFileAttributesEx functions as defined by Microsoft. The empty string is also allowed to support empty emlement associated with variable references.
Value Description FILE_ATTRIBUTE_DIRECTORY The handle identifies a directory.
FILE_TYPE_CHAR The specified file is a character file, typically an LPT device or a console.
FILE_TYPE_DISK The specified file is a disk file.
FILE_TYPE_PIPE The specified file is a socket, a named pipe, or an anonymous pipe.
FILE_TYPE_REMOTE Unused.
FILE_TYPE_UNKNOWN Either the type of the specified file is unknown, or the function failed.
The EntityObjectNamingContextType restricts a string value to a specific set of values: domain, configuration, and schema. These values describe the different default naming context found in active directory. A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. The empty string is also allowed to support empty emlement associated with variable references.
Value Description domain configuration schema
The EntityObjectNamingContextType restricts a string value to a specific set of values: domain, configuration, and schema. These values describe the different default naming context found in active directory. A naming context is defined as a single object in the Directory Information Tree (DIT) along with every object in the tree subordinate to it. The empty string is also allowed to support empty emlement associated with variable references.
Value Description domain configuration schema
The EntityObjectProtocolType restricts a string value to a specific set of values: TCP and UDP. These values describe the different protocols available to a port. The empty string is also allowed to support empty emlement associated with variable references.
Value Description TCP UDP
The EntityStateProtocolType restricts a string value to a specific set of values: TCP and UDP. These values describe the different protocols available to a port. The empty string is also allowed to support empty emlement associated with variable references.
Value Description TCP UDP
The EntityObjectRegistryHiveType restricts a string value to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. These values describe the possible hives in the registry. The empty string is also allowed to support empty emlement associated with variable references.
Value Description HKEY_CLASSES_ROOT HKEY_CURRENT_CONFIG HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS
The EntityStateRegistryHiveType restricts a string value to a specific set of values: HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and HKEY_USERS. These values describe the possible hives in the registry. The empty string is also allowed to support empty emlement associated with variable references.
Value Description HKEY_CLASSES_ROOT HKEY_CURRENT_CONFIG HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS
The EntityStateRegistryTypeType complex type defines the different values that are valid for the type entity of a registry state. These values describe the possible types of data stored in a registry key. The empty string is also allowed as a valid value to support an empty element that is found when a variable reference is used within the type entity. Please note that the values identified are for the type entity and are not valid values for the datatype attribute. For information about how to encode registry data in OVAL for each of the different types, please visit the registry_state documentation.
Value Description reg_binary The reg_binary type is used by registry keys that specify binary data in any form.
reg_dword The reg_dword type is used by registry keys that specify a 32-bit number.
reg_expand_sz The reg_expand_sz type is used by registry keys to specify a null-terminated string that contains unexpanded references to environment variables (for example, "%PATH%").
reg_multi_sz The reg_multi_sz type is used by registry keys that specify an array of null-terminated strings, terminated by two null characters.
reg_none The reg_none type is used by registry keys that have no defined value type.
reg_qword The reg_qword type is used by registry keys that specify a 64-bit number.
reg_sz The reg_sz type is used by registry keys that specify a single null-terminated string.
The EntityStateSharedResourceTypeType complex type defines the different values that are valid for the type entity of a shared resource state. Note that the Windows API returns a DWOD and OVAL uses the constant name that is normally defined for these return values. This is done to increase readability and maintainability of OVAL Definitions. The empty string is also allowed as a valid value to support an empty element that is found when a variable reference is used within the type entity.
Value Description STYPE_DISKTREE The STYPE_DISKTREE type means that the shared resource is a disk drive. The DWROD value this corresponds to is 0.
STYPE_PRINTQ The STYPE_PRINTQ type means that the shared resource is a print queue. The DWROD value this corresponds to is 1.
STYPE_DEVICE The STYPE_DEVICE type means that the shared resource is a communication device. The DWROD value this corresponds to is 2.
STYPE_IPC The STYPE_IPC type means that the shared resource is an interprocess communication. The DWROD value this corresponds to is 3.
STYPE_SPECIAL The STYPE_SPECIAL type means that this is a special share reserved for interprocess communication (IPC$) or remote administration of the server (ADMIN$). Can also refer to administrative shares such as C$, D$, E$, and so forth. The DWROD value this corresponds to is 0x40000000.
STYPE_TEMPORARY The STYPE_TEMPORARY type means that the shared resource is a temporary share. The DWROD value this corresponds to is 0x80000000.