<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<model type="com.apple.IDECoreDataModeler.DataModel" documentVersion="1.0" lastSavedToolsVersion="24299" systemVersion="25B78" minimumToolsVersion="Automatic" sourceLanguage="Swift" userDefinedModelVersionIdentifier="">
    <entity name="ESActionResult" representedClassName="ESActionResult" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="result_type" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="result_type_human" optional="YES" attributeType="String"/>
        <relationship name="result" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuthResult"/>
    </entity>
    <entity name="ESAuditToken" representedClassName="ESAuditToken" syncable="YES">
        <attribute name="asid" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="auid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="egid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="euid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="pid" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="pidversion" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="rgid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="ruid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
    </entity>
    <entity name="ESAuthorizationJudgementEvent" representedClassName="ESAuthorizationJudgementEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="result_count" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="resultsData" optional="YES" attributeType="Binary"/>
        <attribute name="return_code" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <relationship name="instigator" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="instigator_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="petitioner" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="petitioner_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
    </entity>
    <entity name="ESAuthorizationPetitionEvent" representedClassName="ESAuthorizationPetitionEvent" syncable="YES">
        <attribute name="flags" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="flagsData" optional="YES" attributeType="Binary"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="right_count" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="rightsData" optional="YES" attributeType="Binary"/>
        <relationship name="instigator" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="instigator_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="petitioner" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="petitioner_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
    </entity>
    <entity name="ESAuthResult" representedClassName="ESAuthResult" syncable="YES">
        <attribute name="auth" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="auth_human" optional="YES" attributeType="String"/>
        <attribute name="flags" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
    </entity>
    <entity name="ESCodeSignatureInvalidatedEvent" representedClassName="ESCodeSignatureInvalidatedEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
    </entity>
    <entity name="ESEventType" representedClassName="ESEventType" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="authorization_judgement" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuthorizationJudgementEvent"/>
        <relationship name="authorization_petition" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuthorizationPetitionEvent"/>
        <relationship name="btm_launch_item_add" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESLaunchItemAddEvent"/>
        <relationship name="btm_launch_item_remove" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESLaunchItemRemoveEvent"/>
        <relationship name="close" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFileCloseEvent"/>
        <relationship name="create" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFileCreateEvent"/>
        <relationship name="cs_invalidated" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESCodeSignatureInvalidatedEvent"/>
        <relationship name="deleteextattr" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESXattrDeleteEvent"/>
        <relationship name="dup" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFDDuplicateEvent"/>
        <relationship name="exec" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcessExecEvent"/>
        <relationship name="exit" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcessExitEvent"/>
        <relationship name="fork" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcessForkEvent"/>
        <relationship name="gatekeeper_user_override" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESGatekeeperUserOverrideEvent"/>
        <relationship name="get_task" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESGetTaskEvent"/>
        <relationship name="getextattr" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESXattrGetEvent"/>
        <relationship name="iokit_open" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESIOKitOpenEvent"/>
        <relationship name="link" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESLinkEvent"/>
        <relationship name="listextattr" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESXattrListEvent"/>
        <relationship name="login_login" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESLoginLoginEvent"/>
        <relationship name="lw_session_login" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESLWLoginEvent"/>
        <relationship name="lw_session_unlock" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESLWUnlockEvent"/>
        <relationship name="mmap" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESMMapEvent"/>
        <relationship name="mount" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESMountEvent"/>
        <relationship name="mprotect" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESMProtectEvent"/>
        <relationship name="od_attribute_value_add" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESODAttributeValueAddEvent"/>
        <relationship name="od_create_group" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESODCreateGroupEvent"/>
        <relationship name="od_create_user" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESODCreateUserEvent"/>
        <relationship name="od_group_add" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESODGroupAddEvent"/>
        <relationship name="od_group_remove" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESODGroupRemoveEvent"/>
        <relationship name="od_modify_password" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESODModifyPasswordEvent"/>
        <relationship name="open" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFileOpenEvent"/>
        <relationship name="openssh_login" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESOpenSSHLoginEvent"/>
        <relationship name="openssh_logout" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESOpenSSHLogoutEvent"/>
        <relationship name="proc_check" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcessCheckEvent"/>
        <relationship name="proc_suspend_resume" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcessSocketEvent"/>
        <relationship name="profile_add" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProfileAddEvent"/>
        <relationship name="pty_grant" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESPTYGrantEvent"/>
        <relationship name="remote_thread_create" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESRemoteThreadCreateEvent"/>
        <relationship name="rename" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFileRenameEvent"/>
        <relationship name="setextattr" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESXattrSetEvent"/>
        <relationship name="setmode" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESSetModeEvent"/>
        <relationship name="signal" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcessSignalEvent"/>
        <relationship name="tcc_modify" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESTCCModifyEvent"/>
        <relationship name="trace" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcessTraceEvent"/>
        <relationship name="uipc_bind" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESUIPCBindEvent"/>
        <relationship name="uipc_connect" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESUIPCConnectEvent"/>
        <relationship name="unlink" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFileDeleteEvent"/>
        <relationship name="write" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFileWriteEvent"/>
        <relationship name="xp_malware_detected" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESXProtectDetect"/>
        <relationship name="xp_malware_remediated" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESXProtectRemediate"/>
        <relationship name="xpc_connect" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESXPCConnectEvent"/>
    </entity>
    <entity name="ESFDDuplicateEvent" representedClassName="ESFDDuplicateEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESFile" representedClassName="ESFile" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="name" optional="YES" attributeType="String"/>
        <attribute name="path" optional="YES" attributeType="String"/>
        <attribute name="path_truncated" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <relationship name="stat" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESStat"/>
    </entity>
    <entity name="ESFileCloseEvent" representedClassName="ESFileCloseEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="modified" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="was_mapped_writable" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESFileCreateEvent" representedClassName="ESFileCreateEvent" syncable="YES">
        <attribute name="acl" optional="YES" attributeType="String"/>
        <attribute name="destination_type" optional="YES" attributeType="Integer 16" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="destination_type_string" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="is_quarantined" optional="YES" attributeType="Integer 16" usesScalarValueType="YES"/>
        <relationship name="destination" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFileDestination"/>
    </entity>
    <entity name="ESFileDeleteEvent" representedClassName="ESFileDeleteEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="parent_dir" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESFileDestination" representedClassName="ESFileDestination" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="existing_file" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
        <relationship name="new_path" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESNewPath"/>
    </entity>
    <entity name="ESFileOpenEvent" representedClassName="ESFileOpenEvent" syncable="YES">
        <attribute name="fflag" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="file" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESFilePathUnion" representedClassName="ESFilePathUnion" syncable="YES">
        <attribute name="file_path" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="file" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESFileRenameEvent" representedClassName="ESFileRenameEvent" syncable="YES">
        <attribute name="destination_path" optional="YES" attributeType="String"/>
        <attribute name="destination_type" optional="YES" attributeType="Integer 16" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="destination_type_string" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="is_quarantined" optional="YES" attributeType="Integer 16" usesScalarValueType="YES"/>
        <relationship name="destination" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFileDestination"/>
        <relationship name="source" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESFileWriteEvent" representedClassName="ESFileWriteEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESGatekeeperUserOverrideEvent" representedClassName="ESGatekeeperUserOverrideEvent" syncable="YES">
        <attribute name="file_path" optional="YES" attributeType="String"/>
        <attribute name="file_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="file_type_string" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="sha256" optional="YES" attributeType="String"/>
        <relationship name="file" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
        <relationship name="signing_info" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESSignedFileInfo"/>
    </entity>
    <entity name="ESGetTaskEvent" representedClassName="ESGetTaskEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="type" optional="YES" attributeType="Integer 16" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="type_string" optional="YES" attributeType="String"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
    </entity>
    <entity name="ESIOKitOpenEvent" representedClassName="ESIOKitOpenEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="parent_path" optional="YES" attributeType="String"/>
        <attribute name="parent_registry_id" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="user_client_class" optional="YES" attributeType="String"/>
        <attribute name="user_client_type" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
    </entity>
    <entity name="ESLaunchItem" representedClassName="ESLaunchItem" syncable="YES">
        <attribute name="app_path" optional="YES" attributeType="String"/>
        <attribute name="app_url" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="item_path" optional="YES" attributeType="String"/>
        <attribute name="item_type" optional="YES" attributeType="Integer 16" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="item_type_string" optional="YES" attributeType="String"/>
        <attribute name="item_url" optional="YES" attributeType="String"/>
        <attribute name="legacy" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="managed" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="plist_contents" optional="YES" attributeType="String"/>
        <attribute name="uid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="uid_human" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESLaunchItemAddEvent" representedClassName="ESLaunchItemAddEvent" syncable="YES">
        <attribute name="executable_path" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="app" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="app_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="instigator" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="instigator_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="item" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESLaunchItem"/>
    </entity>
    <entity name="ESLaunchItemRemoveEvent" representedClassName="ESLaunchItemRemoveEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="app" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="app_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="instigator" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="instigator_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="item" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESLaunchItem"/>
    </entity>
    <entity name="ESLinkEvent" representedClassName="ESLinkEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="target_filename" optional="YES" attributeType="String"/>
        <relationship name="source" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
        <relationship name="target_dir" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESLoginLoginEvent" representedClassName="ESLoginLoginEvent" syncable="YES">
        <attribute name="failure_message" optional="YES" attributeType="String"/>
        <attribute name="has_uid" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="success" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="uid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="uid_human" optional="YES" attributeType="String"/>
        <attribute name="username" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESLWLoginEvent" representedClassName="ESLWLoginEvent" syncable="YES">
        <attribute name="graphical_session_id" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="username" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESLWUnlockEvent" representedClassName="ESLWUnlockEvent" syncable="YES">
        <attribute name="graphical_session_id" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="username" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESMessage" representedClassName="ESMessage" syncable="YES">
        <attribute name="action_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="action_type_string" optional="YES" attributeType="String"/>
        <attribute name="actionResultData" optional="YES" attributeType="Binary"/>
        <attribute name="audit_token" optional="YES" attributeType="String"/>
        <attribute name="context" optional="YES" attributeType="String"/>
        <attribute name="es_event_type" optional="YES" attributeType="String"/>
        <attribute name="event_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="global_seq_num" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="group_id" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="mach_time" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="macOS" optional="YES" attributeType="String"/>
        <attribute name="message_darwin_time" optional="YES" attributeType="Date" usesScalarValueType="NO"/>
        <attribute name="parent_audit_token" optional="YES" attributeType="String"/>
        <attribute name="parent_unique_id" optional="YES" attributeType="String"/>
        <attribute name="path_is_truncated" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="responsible_audit_token" optional="YES" attributeType="String"/>
        <attribute name="schema_version" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="sensor_id" optional="YES" attributeType="String"/>
        <attribute name="seq_num" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="sub_type" optional="YES" attributeType="String"/>
        <attribute name="target_path" optional="YES" attributeType="String"/>
        <attribute name="time" optional="YES" attributeType="String"/>
        <attribute name="version" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <relationship name="correlated_events" optional="YES" toMany="YES" deletionRule="Cascade" destinationEntity="ESMessage"/>
        <relationship name="correlated_gid_events" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESMessage"/>
        <relationship name="event" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESEventType"/>
        <relationship name="process" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="thread" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESThread"/>
    </entity>
    <entity name="ESMMapEvent" representedClassName="ESMMapEvent" syncable="YES">
        <attribute name="file_pos" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="flags" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="max_protection" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="protection" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <relationship name="source" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESMountEvent" representedClassName="ESMountEvent" syncable="YES">
        <attribute name="disposition" optional="YES" attributeType="Integer 16" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="disposition_string" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="statfsData" optional="YES" attributeType="Binary"/>
    </entity>
    <entity name="ESMProtectEvent" representedClassName="ESMProtectEvent" syncable="YES">
        <attribute name="address" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="flagsData" optional="YES" attributeType="Binary"/>
        <attribute name="hex_address" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="kb_size" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="protection" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="size" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
    </entity>
    <entity name="ESNewPath" representedClassName="ESNewPath" syncable="YES">
        <attribute name="filename" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="mode" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <relationship name="dir" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESODAttributeValueAddEvent" representedClassName="ESODAttributeValueAddEvent" syncable="YES">
        <attribute name="attribute_name" optional="YES" attributeType="String"/>
        <attribute name="attribute_value" optional="YES" attributeType="String"/>
        <attribute name="db_path" optional="YES" attributeType="String"/>
        <attribute name="error_code" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="error_code_human" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="instigator_process_audit_token" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_name" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_path" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_signing_id" optional="YES" attributeType="String"/>
        <attribute name="node_name" optional="YES" attributeType="String"/>
        <attribute name="record_name" optional="YES" attributeType="String"/>
        <attribute name="record_type" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESODCreateGroupEvent" representedClassName="ESODCreateGroupEvent" syncable="YES">
        <attribute name="db_path" optional="YES" attributeType="String"/>
        <attribute name="error_code" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="error_code_human" optional="YES" attributeType="String"/>
        <attribute name="group_name" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="instigator_process_audit_token" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_name" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_path" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_signing_id" optional="YES" attributeType="String"/>
        <attribute name="node_name" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESODCreateUserEvent" representedClassName="ESODCreateUserEvent" syncable="YES">
        <attribute name="db_path" optional="YES" attributeType="String"/>
        <attribute name="error_code" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="error_code_human" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="instigator_process_audit_token" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_name" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_path" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_signing_id" optional="YES" attributeType="String"/>
        <attribute name="node_name" optional="YES" attributeType="String"/>
        <attribute name="user_name" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESODGroupAddEvent" representedClassName="ESODGroupAddEvent" syncable="YES">
        <attribute name="db_path" optional="YES" attributeType="String"/>
        <attribute name="error_code" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="error_code_human" optional="YES" attributeType="String"/>
        <attribute name="group_name" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="instigator_process_audit_token" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_name" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_path" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_signing_id" optional="YES" attributeType="String"/>
        <attribute name="member" optional="YES" attributeType="String"/>
        <attribute name="node_name" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESODGroupRemoveEvent" representedClassName="ESODGroupRemoveEvent" syncable="YES">
        <attribute name="db_path" optional="YES" attributeType="String"/>
        <attribute name="error_code" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="error_code_human" optional="YES" attributeType="String"/>
        <attribute name="group_name" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="instigator_process_audit_token" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_name" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_path" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_signing_id" optional="YES" attributeType="String"/>
        <attribute name="member" optional="YES" attributeType="String"/>
        <attribute name="node_name" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESODModifyPasswordEvent" representedClassName="ESODModifyPasswordEvent" syncable="YES">
        <attribute name="account_name" optional="YES" attributeType="String"/>
        <attribute name="account_type" optional="YES" attributeType="String"/>
        <attribute name="db_path" optional="YES" attributeType="String"/>
        <attribute name="error_code" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="error_code_human" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="instigator_process_audit_token" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_name" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_path" optional="YES" attributeType="String"/>
        <attribute name="instigator_process_signing_id" optional="YES" attributeType="String"/>
        <attribute name="node_name" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESOpenSSHLoginEvent" representedClassName="ESOpenSSHLoginEvent" syncable="YES">
        <attribute name="has_uid" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="result_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="result_type_string" optional="YES" attributeType="String"/>
        <attribute name="source_address" optional="YES" attributeType="String"/>
        <attribute name="source_address_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="source_address_type_string" optional="YES" attributeType="String"/>
        <attribute name="success" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="uid" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="username" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESOpenSSHLogoutEvent" representedClassName="ESOpenSSHLogoutEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="source_address" optional="YES" attributeType="String"/>
        <attribute name="source_address_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="source_address_type_string" optional="YES" attributeType="String"/>
        <attribute name="uid" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="username" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESProcess" representedClassName="ESProcess" syncable="YES">
        <attribute name="allow_jit" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="audit_token_string" optional="YES" attributeType="String"/>
        <attribute name="cdhash" optional="YES" attributeType="String"/>
        <attribute name="codesigning_flags" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="codesigning_type" optional="YES" attributeType="String"/>
        <attribute name="cs_validation_category" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="cs_validation_category_string" optional="YES" attributeType="String"/>
        <attribute name="euid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="euid_human" optional="YES" attributeType="String"/>
        <attribute name="file_quarantine_type" optional="YES" attributeType="String"/>
        <attribute name="get_task_allow" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="group_id" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="is_adhoc_signed" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="is_es_client" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="is_file_quarantine_aware" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="is_platform_binary" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="original_ppid" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="parent_audit_token_string" optional="YES" attributeType="String"/>
        <attribute name="pid" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="ppid" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="responsible_audit_token_string" optional="YES" attributeType="String"/>
        <attribute name="rootless" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="ruid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="ruid_human" optional="YES" attributeType="String"/>
        <attribute name="session_id" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="signing_id" optional="YES" attributeType="String"/>
        <attribute name="skip_lv" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="start_time" optional="YES" attributeType="String"/>
        <attribute name="team_id" optional="YES" attributeType="String"/>
        <relationship name="audit_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="executable" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
        <relationship name="parent_audit_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="responsible_audit_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="tty" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESProcessCheckEvent" representedClassName="ESProcessCheckEvent" syncable="YES">
        <attribute name="flavor" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="type_string" optional="YES" attributeType="String"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
    </entity>
    <entity name="ESProcessExecEvent" representedClassName="ESProcessExecEvent" syncable="YES">
        <attribute name="allow_jit" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="argsData" optional="YES" attributeType="Binary"/>
        <attribute name="cdhash" optional="YES" attributeType="String"/>
        <attribute name="certificateChainData" optional="YES" attributeType="Binary"/>
        <attribute name="command_line" optional="YES" attributeType="String"/>
        <attribute name="cs_type" optional="YES" attributeType="String"/>
        <attribute name="dyld_exec_path" optional="YES" attributeType="String"/>
        <attribute name="envData" optional="YES" attributeType="Binary"/>
        <attribute name="euid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="euid_human" optional="YES" attributeType="String"/>
        <attribute name="fdsData" optional="YES" attributeType="Binary"/>
        <attribute name="file_quarantine_type" optional="YES" attributeType="Integer 16" usesScalarValueType="YES"/>
        <attribute name="get_task_allow" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="group_id" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="image_cpusubtype" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="image_cputype" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="is_adhoc_signed" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="is_es_client" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="is_platform_binary" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="last_fd" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="pid" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="process_name" optional="YES" attributeType="String"/>
        <attribute name="process_path" optional="YES" attributeType="String"/>
        <attribute name="resolved_script_path" optional="YES" attributeType="String"/>
        <attribute name="rootless" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="ruid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="ruid_human" optional="YES" attributeType="String"/>
        <attribute name="script_content" optional="YES" attributeType="String"/>
        <attribute name="signing_id" optional="YES" attributeType="String"/>
        <attribute name="skip_lv" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="start_time" optional="YES" attributeType="String"/>
        <attribute name="submitted_by_audit_token" optional="YES" attributeType="String"/>
        <attribute name="target_proc_audit_token_string" optional="YES" attributeType="String"/>
        <attribute name="target_proc_parent_audit_token_string" optional="YES" attributeType="String"/>
        <attribute name="target_proc_responsible_audit_token_string" optional="YES" attributeType="String"/>
        <attribute name="team_id" optional="YES" attributeType="String"/>
        <attribute name="unique_id" optional="YES" attributeType="String"/>
        <relationship name="cwd" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
        <relationship name="script" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
    </entity>
    <entity name="ESProcessExitEvent" representedClassName="ESProcessExitEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="stat" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
    </entity>
    <entity name="ESProcessForkEvent" representedClassName="ESProcessForkEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="child" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
    </entity>
    <entity name="ESProcessSignalEvent" representedClassName="ESProcessSignalEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="sig" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="signal_name" optional="YES" attributeType="String"/>
        <relationship name="instigator" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
    </entity>
    <entity name="ESProcessSocketEvent" representedClassName="ESProcessSocketEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="type_string" optional="YES" attributeType="String"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
    </entity>
    <entity name="ESProcessTraceEvent" representedClassName="ESProcessTraceEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
    </entity>
    <entity name="ESProfileAddEvent" representedClassName="ESProfileAddEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="is_update" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <attribute name="profileData" optional="YES" attributeType="Binary"/>
        <relationship name="instigator" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="instigator_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
    </entity>
    <entity name="ESPTYGrantEvent" representedClassName="ESPTYGrantEvent" syncable="YES">
        <attribute name="dev" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
    </entity>
    <entity name="ESRemoteThreadCreateEvent" representedClassName="ESRemoteThreadCreateEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="thread_state" optional="YES" attributeType="String"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
    </entity>
    <entity name="ESSetModeEvent" representedClassName="ESSetModeEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="mode" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESSignedFileInfo" representedClassName="ESSignedFileInfo" syncable="YES">
        <attribute name="cdhash" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="signing_id" optional="YES" attributeType="String"/>
        <attribute name="team_id" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESStat" representedClassName="ESStat" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="st_atimespec" optional="YES" attributeType="String"/>
        <attribute name="st_birthtimespec" optional="YES" attributeType="String"/>
        <attribute name="st_blksize" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_blocks" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_ctimespec" optional="YES" attributeType="String"/>
        <attribute name="st_dev" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_flags" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_gen" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_gid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_ino" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_mode" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_mtimespec" optional="YES" attributeType="String"/>
        <attribute name="st_nlink" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_rdev" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_size" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="st_uid" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
    </entity>
    <entity name="ESTCCModifyEvent" representedClassName="ESTCCModifyEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="identity" optional="YES" attributeType="String"/>
        <attribute name="identity_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="identity_type_string" optional="YES" attributeType="String"/>
        <attribute name="reason" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="reason_string" optional="YES" attributeType="String"/>
        <attribute name="right" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="right_string" optional="YES" attributeType="String"/>
        <attribute name="service" optional="YES" attributeType="String"/>
        <attribute name="update_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="update_type_string" optional="YES" attributeType="String"/>
        <relationship name="instigator" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="instigator_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
        <relationship name="responsible" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESProcess"/>
        <relationship name="responsible_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
    </entity>
    <entity name="ESThread" representedClassName="ESThread" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="thread_id" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
    </entity>
    <entity name="ESTimeSpec" representedClassName="ESTimeSpec" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="tv_nsec" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="tv_sec" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
    </entity>
    <entity name="ESTimeVal" representedClassName="ESTimeVal" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="tv_sec" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="tv_usec" optional="YES" attributeType="Integer 64" defaultValueString="0" usesScalarValueType="YES"/>
    </entity>
    <entity name="ESUIPCBindEvent" representedClassName="ESUIPCBindEvent" syncable="YES">
        <attribute name="filename" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="mode" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <relationship name="dir" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESUIPCConnectEvent" representedClassName="ESUIPCConnectEvent" syncable="YES">
        <attribute name="domain" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="domain_string" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="protocol" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="protocol_string" optional="YES" attributeType="String"/>
        <attribute name="type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="type_string" optional="YES" attributeType="String"/>
        <relationship name="file" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESXattrDeleteEvent" representedClassName="ESXattrDeleteEvent" syncable="YES">
        <attribute name="extattr" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESXattrGetEvent" representedClassName="ESXattrGetEvent" syncable="YES">
        <attribute name="extattr" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESXattrListEvent" representedClassName="ESXattrListEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESXattrSetEvent" representedClassName="ESXattrSetEvent" syncable="YES">
        <attribute name="extattr" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <relationship name="target" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESFile"/>
    </entity>
    <entity name="ESXPCConnectEvent" representedClassName="ESXPCConnectEvent" syncable="YES">
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="service_domain_type" optional="YES" attributeType="Integer 32" defaultValueString="0" usesScalarValueType="YES"/>
        <attribute name="service_domain_type_string" optional="YES" attributeType="String"/>
        <attribute name="service_name" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESXProtectDetect" representedClassName="ESXProtectDetect" syncable="YES">
        <attribute name="detected_executable" optional="YES" attributeType="String"/>
        <attribute name="detected_path" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="incident_identifier" optional="YES" attributeType="String"/>
        <attribute name="malware_identifier" optional="YES" attributeType="String"/>
        <attribute name="signature_version" optional="YES" attributeType="String"/>
    </entity>
    <entity name="ESXProtectRemediate" representedClassName="ESXProtectRemediate" syncable="YES">
        <attribute name="action_type" optional="YES" attributeType="String"/>
        <attribute name="id" optional="YES" attributeType="UUID" usesScalarValueType="NO"/>
        <attribute name="incident_identifier" optional="YES" attributeType="String"/>
        <attribute name="malware_identifier" optional="YES" attributeType="String"/>
        <attribute name="remediated_path" optional="YES" attributeType="String"/>
        <attribute name="result_description" optional="YES" attributeType="String"/>
        <attribute name="signature_version" optional="YES" attributeType="String"/>
        <attribute name="success" optional="YES" attributeType="Boolean" usesScalarValueType="YES"/>
        <relationship name="remediated_process_audit_token" optional="YES" maxCount="1" deletionRule="Nullify" destinationEntity="ESAuditToken"/>
    </entity>
</model>