The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

XML schema for OS changes—Macintosh

  • Published on Aug 25, 2026
  • 11 minute(s) read
Prev Next

The following schema is for Macintosh.

<?xml version="1.0" encoding="UTF-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
  elementFormDefault="qualified" targetNamespace="http://www.trellix.com/alert/2014/AlertSchema"
  xmlns="http://www.trellix.com/alert/2014/AlertSchema">
  <xs:include schemaLocation="MacintoshOSCDataSet.xsd" />
  <xs:element name="alerts">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="alert" minOccurs="0" maxOccurs="unbounded" />
      </xs:sequence>
      <xs:attribute name="appliance" use="required" type="xs:string" />
      <!--
      Appliance ID, which is the MAC addr
      -->
      <xs:attribute name="appliance-id" use="optional" type="xs:string" />
      <xs:attribute name="product" use="optional" type="ProductType" />
      <xs:attribute name="version" use="optional" type="xs:string" />
      <xs:attribute name="msg" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="alert">
    <xs:complexType>
      <xs:all>
        <xs:element ref="explanation" minOccurs="0" />
        <xs:element ref="src" minOccurs="0" />
        <xs:element ref="alert-url" minOccurs="0" />
        <xs:element ref="action" minOccurs="0" />
        <xs:element ref="locations" minOccurs="0" />
        <xs:element name="description"  type="xs:string"  minOccurs="0" />
        <xs:element name="occurred" type="feDateTime" minOccurs="0" />
        <xs:element minOccurs="0" name="dst">
          <xs:complexType>
            <xs:all>
              <xs:element ref="mac" minOccurs="0" />
              <xs:element name="port" type="xs:integer" minOccurs="0" />
              <xs:element ref="ip" minOccurs="0" />
              <xs:element name="smtp-to" type="xs:string" minOccurs="0" />
              <xs:element name="smtp-cc" type="xs:string" minOccurs="0" />
            </xs:all>
          </xs:complexType>
        </xs:element>
        <xs:element maxOccurs="1" minOccurs="0" name="smtp-message">
          <xs:complexType>
            <xs:all>
              <xs:element name="subject" type="xs:string" minOccurs="0" />
              <xs:element minOccurs="0" name="smtp-header" type="xs:string" />
              <xs:element minOccurs="0" name="last-malware" type="xs:string" />
              <xs:element minOccurs="0" name="protocol" type="xs:string" />
              <xs:element name="date" type="xs:string" />
            </xs:all>
            <xs:attribute name="id" type="xs:string" use="required" />
            <xs:attribute name="queue-id" type="xs:string" use="optional" />						
          </xs:complexType>
        </xs:element>
        <xs:element name="interface" minOccurs="0">
          <xs:complexType>
            <xs:simpleContent>
              <xs:extension base="xs:string">
                <xs:attribute name="label" type="InterfaceLabel" />
                <xs:attribute name="mode" type="InterfaceMode" />
              </xs:extension>
            </xs:simpleContent>
          </xs:complexType>
        </xs:element>
      </xs:all>
      <!--
      Appliance ID, which is the MAC addr
      -->
      <xs:attribute name="appliance-id" use="optional" type="xs:string" />									
      <xs:attribute name="id" use="required" type="xs:long" />
      <xs:attribute name="root-infection" use="optional" type="xs:unsignedLong" />
      <xs:attribute name="sensor-ip" use="optional" type="xs:string" />
      <xs:attribute name="name" use="required" type="AlertType" />
      <xs:attribute name="retroactive" use="optional" type="RetroActiveType" />
      <xs:attribute name="severity" use="optional" type="AlertSeverity" />
      <xs:attribute name="uuid" use="optional" type="xs:string" />
      <xs:attribute name="ack" use="optional" type="xs:string" />
      <xs:attribute name="product" use="optional" type="ProductType" />
      <xs:attribute name="version" use="optional" type="xs:string" />
      <xs:attribute name="sigid" use="optional" type="xs:int" />
      <xs:attribute name="sensor" use="optional" type="xs:string" />
      <xs:attribute name="sigrevision" use="optional" type="xs:int" />
      <xs:attribute name="matchcount" use="optional" type="xs:long" />
      <!--  
        ips rule name, this is used only for ips event 
        added on : 03/17 2014			   
      -->
      <xs:attribute name="signame" use="optional" type="xs:string" />
      <xs:attribute name="vlan" use="optional" type="xs:integer" />
      <xs:attribute name="class" use="optional" type="AlertCategoryType" />
      <xs:attribute name="malicious" use="optional" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="explanation">
    <xs:complexType>
      <xs:sequence>
        <!-- for ips events -->
        <xs:element minOccurs="0" name="ips-detected">
          <xs:complexType>
            <xs:sequence>
              <xs:element maxOccurs="unbounded" minOccurs="0" ref="ips-event" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>			
        <xs:element minOccurs="0" name="malware-detected">
          <xs:complexType>
            <xs:sequence>
              <xs:element maxOccurs="unbounded" minOccurs="0" ref="malware" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" name="cnc-services">
          <xs:complexType>
            <xs:sequence>
              <xs:element maxOccurs="unbounded" minOccurs="0" ref="cnc-service" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element name="os-changes" maxOccurs="unbounded" minOccurs="0">
          <xs:complexType>
            <xs:complexContent>
              <xs:extension base="OSCChangeSet">
                <xs:attribute name="osinfo" type="xs:string" />
                <xs:attribute name="id" type="xs:long" />
                <xs:attribute name="version" type="xs:string" use="optional" />
              </xs:extension>
            </xs:complexContent>
          </xs:complexType>
        </xs:element>
        <xs:element minOccurs="0" name="static-analysis">
          <xs:complexType>
            <xs:sequence>
              <xs:element maxOccurs="unbounded" minOccurs="0" ref="static" />
            </xs:sequence>
          </xs:complexType>
        </xs:element>
        <xs:element name="service" type="xs:string" minOccurs="0" />
        <xs:element ref="anomaly" minOccurs="0" />
        <xs:element ref="target-application" minOccurs="0" />
        <xs:element ref="target-os" minOccurs="0" />
        <xs:element ref="osinfo" minOccurs="0" />
        <xs:element ref="stolen_data" minOccurs="0" />
      </xs:sequence>
      <xs:attribute name="analysis" use="optional" type="xs:NCName" />
      <xs:attribute name="protocol" use="optional" type="xs:string" />
      <xs:attribute name="urls" use="optional" type="xs:integer" />
    </xs:complexType>
  </xs:element>
  <!-- 
  ips related information	
  -->
  <xs:element name="ips-event">
    <xs:complexType>
      <xs:sequence>
        <xs:element name="sig-id" type="xs:string" minOccurs="0" />
        <xs:element name="sig-revision" type="xs:string" minOccurs="0" />
        <xs:element name="sig-name" type="xs:string" minOccurs="0" />
        <xs:element name="match-count" type="xs:integer" minOccurs="0" />
        <xs:element name="cve-id" type="xs:string" minOccurs="0" />
        <xs:element name="action-taken" type="xs:string" minOccurs="0" />
        <xs:element name="attack-mode" type="xs:string" minOccurs="0" />
        <xs:element name="mvx-status" type="xs:string" minOccurs="0" />				
      </xs:sequence>
    </xs:complexType>				
  </xs:element>
  <xs:element name="malware">
    <xs:complexType mixed="false">
      <xs:all maxOccurs="1" minOccurs="0">
        <xs:element ref="note" minOccurs="0" />
        <xs:element ref="url" minOccurs="0" />
        <xs:element name="profile" type="xs:string" minOccurs="0" />
        <xs:element name="md5sum" type="xs:string" minOccurs="0" />
        <xs:element name="sha1" type="xs:string" minOccurs="0" />
        <xs:element name="sha256" type="xs:string" minOccurs="0" />
        <xs:element name="sha512" type="xs:string" minOccurs="0" />
        <xs:element name="application" type="xs:string" minOccurs="0" />
        <xs:element name="http-header" type="xs:string" minOccurs="0" />
        <xs:element name="domain" type="xs:string" minOccurs="0" />
        <xs:element name="user" type="xs:Name" minOccurs="0" />
        <xs:element name="original" type="xs:string" minOccurs="0" />
        <xs:element name="downloaded-at" type="feDateTime" minOccurs="0" />
        <xs:element name="submitted-at" type="feDateTime" minOccurs="0" />
        <xs:element name="executed-at" type="feDateTime" minOccurs="0" />
        <xs:element minOccurs="0" name="objurl" type="xs:anyURI" />
      </xs:all>
      <xs:attribute name="content" type="xs:string" />
      <xs:attribute name="name" use="optional" type="xs:string" />
      <xs:attribute name="original-infection-id" use="optional" type="xs:integer" />
      <xs:attribute name="original-infection-type" use="optional" type="AlertType" />			
      <xs:attribute name="original-infection-url" use="optional" type="xs:string" />			
      <xs:attribute name="scan" type="xs:integer" />
      <xs:attribute name="sid" type="xs:string" use="optional" />
      <xs:attribute name="type" use="optional" type="xs:string" />
      <xs:attribute name="stype" use="optional" type="xs:string" />
      <xs:attribute name="archives" type="xs:integer" />
      <xs:attribute name="parent" type="xs:long" />
      <xs:attribute name="origid" type="xs:long" />
      <xs:attribute name="malicious" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="note" type="xs:string" />
  <xs:element name="url" type="xs:string" />
  <xs:element name="cnc-service">
    <xs:complexType>
      <xs:all>
        <xs:element name="address" type="xs:string" minOccurs="0" />
        <xs:element ref="channel" minOccurs="0" />
        <xs:element minOccurs="0" name="location" type="xs:string" />
      </xs:all>
      <xs:attribute name="port" use="required" type="xs:integer" />
      <xs:attribute name="protocol" use="optional" type="xs:NCName" />
      <xs:attribute name="sname" use="optional" type="xs:string" />
      <xs:attribute name="type" use="optional" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="channel" type="xs:string" />
  <xs:element name="target-application" type="xs:string" />
  <xs:element name="anomaly" type="xs:string" />
  <xs:element name="target-os" type="xs:string" />
  <xs:element name="osinfo" type="xs:string" />
  <xs:element name="stolen_data">
    <xs:complexType>
      <xs:sequence>
        <xs:element ref="info" minOccurs="0" />
      </xs:sequence>
      <xs:attribute name="event_id" use="optional" type="xs:integer" />
      <xs:attribute name="size" use="optional" type="xs:integer" />
    </xs:complexType>
  </xs:element>
  <xs:element name="info">
    <xs:complexType>
      <xs:sequence>
        <xs:element name="description" type="xs:string" minOccurs="0" />
        <xs:element name="severity" type="xs:string" minOccurs="0" />
        <xs:choice maxOccurs="unbounded" minOccurs="0">
          <xs:element ref="field" />
        </xs:choice>
      </xs:sequence>
      <xs:attribute name="decrypted" use="optional" type="xs:string" />
      <xs:attribute name="encryption" use="optional" type="xs:string" />
      <xs:attribute name="type" use="optional" type="xs:string" />
    </xs:complexType>
  </xs:element>
  <xs:element name="field">
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base="xs:string">
          <xs:attribute name="name" use="optional" type="xs:string" />
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>
  <xs:element name="src">
    <xs:complexType>
      <xs:all maxOccurs="1" minOccurs="0">
        <xs:element ref="ip" minOccurs="0" />
        <xs:element ref="mac" minOccurs="0" />
        <xs:element minOccurs="0" name="host" type="xs:string" />
        <xs:element minOccurs="0" name="port" type="xs:integer" />
        <xs:element maxOccurs="1" minOccurs="0" name="domain" type="xs:string" />
        <xs:element minOccurs="0" name="smtp-mail-from" type="xs:string" />
        <xs:element minOccurs="0" name="repository" type="xs:anyURI" />
        <xs:element minOccurs="0" ref="url" />
        <xs:element name="proxy" type="xs:string" minOccurs="0" />
      </xs:all>
      <xs:attribute name="vlan" use="optional" type="xs:integer" />
    </xs:complexType>
  </xs:element>
  <xs:element name="ip" type="xs:string" />
  <xs:element name="mac" type="xs:string" />
  <xs:element name="alert-url" type="xs:anyURI" />
  <xs:element name="action" type="xs:string" />
  <xs:element name="locations" type="xs:string" />
  <xs:element name="ati-data" type="xs:string" />
  <xs:element name="static">
    <xs:complexType>
      <xs:simpleContent>
        <xs:extension base="xs:string">
          <xs:attribute name="version" type="xs:string" />
          <xs:attribute name="tool" type="xs:string" form="unqualified" use="required" />
        </xs:extension>
      </xs:simpleContent>
    </xs:complexType>
  </xs:element>
  <xs:simpleType name="RetroActiveType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="yes" />                        			
      <xs:enumeration value="no" />                        			
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AlertType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="malware-callback" />
      <xs:enumeration value="domain-match" />
      <xs:enumeration value="infection-match" />
      <xs:enumeration value="web-infection" />
      <xs:enumeration value="malware-object" />
      <xs:enumeration value="ips-event" />                        			
      <xs:enumeration value="riskware-callback" />                        			
      <xs:enumeration value="riskware-object" />                        			
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="feDateTime">
    <xs:restriction base="xs:dateTime">
      <xs:whiteSpace value="collapse" />
    </xs:restriction>
  </xs:simpleType>

  <xs:simpleType name="AlertCategoryType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="IPS" />
      <xs:enumeration value="GENERIC" />                        			
      <xs:enumeration value="RISKWARE" />                        			                        
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="ProductType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="Web MPS" />
      <xs:enumeration value="Email MPS" />
      <xs:enumeration value="File MPS" />
      <xs:enumeration value="MAS" />
      <xs:enumeration value="CMS" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AlertSeverity">
    <xs:restriction base="xs:string">
      <xs:enumeration value="crit" />
      <xs:enumeration value="majr" />
      <xs:enumeration value="minr" />
      <xs:enumeration value="unkn" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AnalysisType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="replay" />
      <xs:enumeration value="malware" />
      <xs:enumeration value="direct" />
      <xs:enumeration value="binary" />
      <xs:enumeration value="content" />
      <xs:enumeration value="none" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="InterfaceLabel">
    <xs:restriction base="xs:string">
      <xs:enumeration value="A" />
      <xs:enumeration value="B" />
      <xs:enumeration value="A1" />
      <xs:enumeration value="B1" />
      <xs:enumeration value="A2" />
      <xs:enumeration value="B2" />
      <xs:enumeration value="C" />
      <xs:enumeration value="D" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="InterfaceMode">
    <xs:restriction base="xs:string">
      <xs:enumeration value="inline" />
      <xs:enumeration value="tap" />
      <!-- for EX Series, we need below extra modes (tap is already included above)  -->
      <xs:enumeration value="drop" />
      <xs:enumeration value="block-email" />
      <xs:enumeration value="monitor" />
    </xs:restriction>
  </xs:simpleType>
</xs:schema>
:

Copyright © 2026 Musarubra US LLC | Privacy | Legal | AI Disclaimer