Documentation for Open Vulnerability and Assessment Language (OVAL®)
Definition Type: Element
Name: value
Namespace: http://oval.mitre.org/XMLSchema/oval-definitions-5#windows
Type: oval-def:EntityStateAnyType
Containing Schema: windows-definitions-schema.xsd
MinOccurs 0
MaxOccurs (1)
Abstract
Documentation:
The value entity allows a test to be written against the value held within the specified registry key(s). If the value being tested is of type REG_BINARY, then the datatype attribute should be set to 'binary' and the data represented by the value entity should follow the xsd:hexBinary form. (each binary octet is encoded as two hex digits) If the value being tested is of type REG_DWORD or REG_QWORD, then the datatype attribute should be set to 'int' and the value entity should represent the data as an integer. If the value being tested is of type REG_EXPAND_SZ, then the datatype attribute should be set to 'string' and the pre-expanded string should be represented by the value entity. If the value being tested is of type REG_MULTI_SZ, then only a single string (one of the multiple strings) should be tested using the value entity with the datatype attribute set to 'string'. In order to test multiple values, multiple OVAL registry tests should be used. If the specified registry key is of type REG_SZ, then the datatype should be 'string' and the value entity should be a copy of the string. Note that if the intention is to test a version number held in the registry (as a reg_sz) then instead of setting the datatype to 'string', the datatype can be set to 'version'. This allows tools performing the evaluation to know how to perform less than and greater than operations correctly.
Collapse XSD Schema Diagram:
Drilldown into var_ref in schema oval-definitions-schema_xsd Drilldown into mask in schema oval-definitions-schema_xsd Drilldown into operation in schema oval-definitions-schema_xsd Drilldown into datatype in schema oval-definitions-schema_xsd Drilldown into EntityBaseType in schema oval-definitions-schema_xsd Drilldown into var_check in schema oval-definitions-schema_xsd Drilldown into entity_check in schema oval-definitions-schema_xsd Drilldown into EntityStateBaseType in schema oval-definitions-schema_xsd Drilldown into EntityStateAnyType in schema oval-definitions-schema_xsdXSD Diagram of value in schema windows-definitions-schema_xsd (Open Vulnerability and Assessment Language (OVAL®))
Collapse XSD Schema Code: 
<xsd:element name="value" type="oval-def:EntityStateAnyType" minOccurs="0">
    <xsd:annotation>
        <xsd:documentation>The value entity allows a test to be written against the value held within the specified registry key(s). If the value being tested is of type REG_BINARY, then the datatype attribute should be set to 'binary' and the data represented by the value entity should follow the xsd:hexBinary form. (each binary octet is encoded as two hex digits) If the value being tested is of type REG_DWORD or REG_QWORD, then the datatype attribute should be set to 'int' and the value entity should represent the data as an integer. If the value being tested is of type REG_EXPAND_SZ, then the datatype attribute should be set to 'string' and the pre-expanded string should be represented by the value entity. If the value being tested is of type REG_MULTI_SZ, then only a single string (one of the multiple strings) should be tested using the value entity with the datatype attribute set to 'string'. In order to test multiple values, multiple OVAL registry tests should be used. If the specified registry key is of type REG_SZ, then the datatype should be 'string' and the value entity should be a copy of the string.</xsd:documentation>
        <xsd:documentation>Note that if the intention is to test a version number held in the registry (as a reg_sz) then instead of setting the datatype to 'string', the datatype can be set to 'version'. This allows tools performing the evaluation to know how to perform less than and greater than operations correctly.</xsd:documentation>
        <xsd:appinfo>
            <sch:pattern id="regstevalue" xmlns:sch="http://purl.oclc.org/dsdl/schematron">
                <sch:rule context="win-def:registry_state/win-def:value">
                    <sch:assert test="(@datatype='int' and (floor(.) = number(.))) or not(@datatype='int') or not(node())">
                        <sch:value-of select="../@id" /> - The datatype has been set to 'int' but the value is not an integer.</sch:assert>
                    <!-- we can use the xpath 2.0 function matches() to define assertions for other datatypes -->
                </sch:rule>
            </sch:pattern>
        </xsd:appinfo>
    </xsd:annotation>
</xsd:element>
Collapse Child Attributes:
Name Type Default Value Use
datatype oval-def:datatype string Optional
operation oval-def:operation equals Optional
mask oval-def:mask false Optional
var_ref oval-def:var_ref Optional
entity_check oval-def:entity_check all Optional
var_check oval-def:var_check all Optional
Collapse Derivation Tree:
Documentation for Open Vulnerability and Assessment Language (OVAL®)

Generated using Liquid Studio - Developer Bundle 21.0.0.0