Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Entity and Relationship Metadata - AskJ1 Community
<main> <article class="userContent"> <p>The following metadata is assigned by JupiterOne internally to entities and relationships. All internal metadata has <code class="code codeInline" spellcheck="false" tabindex="0">_</code> prefix to the property name.</p> <h2 data-id="class-type-key-and-id">Class, Type, Key and ID</h2> <table><thead><tr><th>Property</th> <th>Type</th> <th>Description</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_class</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string | string[]</code></td> <td>The abstract class label(s) assigned to an entity/relationship. An entity can have multiple class labels while a relationship can only have one.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_type</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string</code></td> <td>The specific type of the resource.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_key</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string</code></td> <td>An identifier of the resource unique within an integration instance or data source scope.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_id</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string</code></td> <td>A globally unique identifier of the resource within JupiterOne.</td> </tr></tbody></table><h2 data-id="timestamps">Timestamps</h2> <p><em>All timestamps are store in Epoch milliseconds and displayed in the UI in ISO date string format.</em></p> <table><thead><tr><th>Property</th> <th>Type</th> <th>Description</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_createdOn</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">number</code></td> <td>The timestamp the entity/relationship was first created in JupiterOne. Usually represents a time after the resource was created in the provider environment.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_beginOn</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">number</code></td> <td>The timestamp when the latest version of entity/relationship was created. Equivalent to last updated timestamp within JupiterOne (<em>not</em> the timestamp of the resource updated in the provider environment).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_endOn</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">number</code></td> <td>THe timestamp a version of the entity/relationship was deleted in JupiterOne.</td> </tr></tbody></table><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Timestamps from the resource provider, if available, are generally normalized<br> to one of the following:</p> </div></blockquote> <p>></p> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">createdOn</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">updatedOn</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">deletedOn</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">startedOn</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">stoppedOn</code></li> </ul></div></blockquote> <h2 data-id="state-and-source-related-metadata">State and source related metadata</h2> <table><thead><tr><th>Property</th> <th>Type</th> <th>Description</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_deleted</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">boolean</code></td> <td>Indicates whether a resource was deleted from JupiterOne graph/CMDB. This typically means the resource was recently deleted from the provider source environment.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_version</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">number</code></td> <td>The version number, which increments every time a change to the resource configuration/attribute is captured.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_source</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string</code></td> <td>The source from where the resource was created. Valid options include: <code class="code codeInline" spellcheck="false" tabindex="0">integration-managed</code>, <code class="code codeInline" spellcheck="false" tabindex="0">powerup-managed</code>, <code class="code codeInline" spellcheck="false" tabindex="0">system-internal</code>, <code class="code codeInline" spellcheck="false" tabindex="0">system-mapper</code>, and <code class="code codeInline" spellcheck="false" tabindex="0">api</code>.</td> </tr></tbody></table><h2 data-id="integration-specific-metadata">Integration specific metadata</h2> <p><em>The following metadata only exists on resources created via an integration.</em></p> <table><thead><tr><th>Property</th> <th>Type</th> <th>Description</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationClass</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string | string[]</code></td> <td>Class of the integration that represents the category or domain of the service provider. For example: <code class="code codeInline" spellcheck="false" tabindex="0">CSP</code>, <code class="code codeInline" spellcheck="false" tabindex="0">IdP</code>, <code class="code codeInline" spellcheck="false" tabindex="0">EDR</code>, <code class="code codeInline" spellcheck="false" tabindex="0">MDM</code>, etc.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationType</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string</code></td> <td>Type of the integration. Typically the service provider name. For example: <code class="code codeInline" spellcheck="false" tabindex="0">aws</code>, <code class="code codeInline" spellcheck="false" tabindex="0">google</code>, <code class="code codeInline" spellcheck="false" tabindex="0">azure</code>, <code class="code codeInline" spellcheck="false" tabindex="0">okta</code>, <code class="code codeInline" spellcheck="false" tabindex="0">knowbe4</code>, <code class="code codeInline" spellcheck="false" tabindex="0">vmware</code>, etc.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationName</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string</code></td> <td>User-provided friendly name of the integration instance.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationDefinitionId</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string</code></td> <td>Internal UUID that identifies the definition for this integration, e.g. AWS, Azure, etc.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationInstanceId</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">string</code></td> <td>Internal UUID that identifies the integration instance. An integration can have more than one configuration instances. For example, multiple AWS accounts have multiple AWS integration instances.</td> </tr></tbody></table> </article> </main>
.png)