event-logging.xsd

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright 2016 - 2018 Crown Copyright
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
-->
<xs:schema xmlns:evt="event-logging:3" xmlns:xs="http://www.w3.org/2001/XMLSchema" targetNamespace="event-logging:3" elementFormDefault="qualified" attributeFormDefault="unqualified" version="4.1.0" id="event-logging-v4.1.0">
  <xs:annotation>
    <xs:documentation>This schema describes the allowed element structure for event logging. Please refer to the documentation and examples for a description of how to use this schema in addition to the descriptions given for each element within this schema.</xs:documentation>
  </xs:annotation>

  <!-- Elements -->

  <xs:element name="Events">
    <xs:annotation>
      <xs:documentation>The root element that contains multiple Event elements.</xs:documentation>
    </xs:annotation>
    <xs:complexType>
      <xs:annotation>
        <xs:documentation>The root element that contains multiple Event elements.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
        <xs:element name="SharingData" type="evt:AnyContentComplexType" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>This element contains data relating to the sharing of a set of events between different systems or organisations. The data contained within this element will confirm to a specification defined outside of this schema.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Event" minOccurs="0" maxOccurs="unbounded">
          <xs:annotation>
            <xs:documentation>A single event that has occurred and been recorded.</xs:documentation>
          </xs:annotation>
          <xs:complexType>
            <xs:annotation>
              <xs:documentation>A single event that has occurred and been recorded.</xs:documentation>
            </xs:annotation>
            <xs:sequence minOccurs="1" maxOccurs="1">
              <xs:element name="Meta" type="evt:AnyContentComplexType" minOccurs="0" maxOccurs="unbounded">
                <xs:annotation>
                  <xs:documentation>This element can be used to supply any metadata relating to the event as long as it conforms to an allowed format/specification (defined outside this XML Schema).</xs:documentation>
                </xs:annotation>
              </xs:element>
              <xs:element name="Classification" type="evt:ClassificationComplexType" minOccurs="0" maxOccurs="1">
                <xs:annotation>
                  <xs:documentation>The classification for the event.</xs:documentation>
                </xs:annotation>
              </xs:element>
              <xs:element name="SharingData" type="evt:AnyContentComplexType" minOccurs="0" maxOccurs="1">
                <xs:annotation>
                  <xs:documentation>This element contains data relating to the sharing of an event between different systems or organisations. The data contained within this element will confirm to a specification defined outside of this schema.</xs:documentation>
                </xs:annotation>
              </xs:element>
              <xs:element name="EventTime" minOccurs="1" maxOccurs="1" type="evt:EventTimeComplexType">
                <xs:annotation>
                  <xs:documentation>This element contains information about the time the event was created.</xs:documentation>
                </xs:annotation>
              </xs:element>
              <xs:element name="EventSource" minOccurs="1" maxOccurs="1" type="evt:EventSourceComplexType">
                <xs:annotation>
                  <xs:documentation>This element details where the event came from, i.e. what generator created the event and on what device.</xs:documentation>
                </xs:annotation>
              </xs:element>
              <xs:element name="EventDetail" minOccurs="1" maxOccurs="1" type="evt:EventDetailComplexType">
                <xs:annotation>
                  <xs:documentation>This element describes the details of what happened in the event: the type of the event, why it happened and the event action.</xs:documentation>
                </xs:annotation>
              </xs:element>
              <xs:element name="EventChain" minOccurs="0" maxOccurs="1" type="evt:EventChainComplexType">
                <xs:annotation>
                  <xs:documentation>This element can be used to create relationships between different events, i.e. where one event is the child of another.</xs:documentation>
                </xs:annotation>
              </xs:element>
              <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
                <xs:annotation>
                  <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit. Can also be used for appending data about the event after it has been received or processed, e.g. for recording details relating to the processing of the event such as the feed name.</xs:documentation>
                </xs:annotation>
              </xs:element>
            </xs:sequence>
          </xs:complexType>
        </xs:element>
      </xs:sequence>
      <xs:attribute name="Version" type="evt:VersionSimpleType" use="required">
        <xs:annotation>
          <xs:documentation>The version of the schema that this document conforms to.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:complexType>
  </xs:element>

  <!-- Groups -->

  <xs:group name="AdvancedQueryOperatorGroup">
    <xs:choice>
      <xs:element name="Term" type="evt:TermComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes a field to search and what to search for using name, condition and value, e.g. Title Contains 'Fox' or Title Equals 'The Quick Brown Fox'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="And" type="evt:AndComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>All of the enclosed items are to be treated as being AND'd together.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Or" type="evt:OrComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>All of the enclosed items are to be treated as being OR'd together.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Not" type="evt:NotComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The enclosed structure operators and terms are negated.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:choice>
  </xs:group>
  <xs:group name="BaseObjectGroup">
    <xs:sequence>
      <xs:element name="Meta" type="evt:AnyContentComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>This element can be used to supply any metadata relating to an object as long as it conforms to an allowed format/specification (defined outside this XML Schema). This can be used for adding metadata to the event after receipt.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Type" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The type of the object in question and specific to the object type from the list above, e.g. a 'Resource' object may have a type such as 'image' or 'script'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>An identifier for the object, e.g a document ID in a document management system. This ID is likely to be specific to the system that generated the event.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the object, e.g. a filename.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Human readable description of what the object is.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Classification" type="evt:ClassificationComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Any classification, protective marking or restrictions placed on the object, e.g. for commercially sensitive reports or user health records.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="State" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Any state information about the object, e.g. 'Archived'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Groups" type="evt:GroupsComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Any groups associated with the object, e.g. group membership of a user account.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Permissions" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The collection of permissions associated with the object, e.g. write access being granted to a list of named users.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>The collection of permissions associated with the object, e.g. write access being granted to a list of named users.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Permission" minOccurs="1" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>A permission rule associated with an object, e.g. read and write access being granted to a user.</xs:documentation>
              </xs:annotation>
              <xs:complexType>
                <xs:annotation>
                  <xs:documentation>A permission rule associated with an object, e.g. read and write access being granted to a user.</xs:documentation>
                </xs:annotation>
                <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:choice minOccurs="1" maxOccurs="1">
                    <xs:element name="User" type="evt:UserComplexType" minOccurs="1" maxOccurs="1">
                      <xs:annotation>
                        <xs:documentation>A user that has been granted (or is prevented from having) some form of permission.</xs:documentation>
                      </xs:annotation>
                    </xs:element>
                    <xs:element name="Group" type="evt:GroupComplexType" minOccurs="1" maxOccurs="1">
                      <xs:annotation>
                        <xs:documentation>A named group of users that has been granted (or is prevented from having) some form of permission.</xs:documentation>
                      </xs:annotation>
                    </xs:element>
                  </xs:choice>
                  <xs:element name="Allow" type="evt:PermissionAttributeSimpleType" minOccurs="0" maxOccurs="unbounded">
                    <xs:annotation>
                      <xs:documentation>The permission attributes that have been explicitly allowed.</xs:documentation>
                    </xs:annotation>
                  </xs:element>
                  <xs:element name="Deny" type="evt:PermissionAttributeSimpleType" minOccurs="0" maxOccurs="unbounded">
                    <xs:annotation>
                      <xs:documentation>The permission attributes that have been explicitly denied.</xs:documentation>
                    </xs:annotation>
                  </xs:element>
                  <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
                    <xs:annotation>
                      <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                    </xs:annotation>
                  </xs:element>
                </xs:sequence>
              </xs:complexType>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Tags" minOccurs="0" maxOccurs="1" type="evt:MetaDataTagsComplexType">
        <xs:annotation>
          <xs:documentation>Metadata tags that can be used for additional object tagging or categorisation. Object tagging allows for the labelling (or filtering) of objects using words that label, categorise or group similar items, using a taxonomy defined outside this schema. For example, an email could be tagged with tags like 'internal', 'spam', 'external', 'rich-content', etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:group>
  <xs:group name="CriteriaExtensionGroup">
    <xs:sequence>
      <xs:element name="DataSources" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A collection of Datasource definitions that are referenced by the criteria/query</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>A collection of Datasource definitions that are referenced by the criteria/query</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="DataSource" type="xs:string" minOccurs="1" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>The name or path of one or more datasources or datasets that are used by a criteria/query, e.g. 'EuroVoc XML distribution' or 'hdfs://mynamenode:8020/datasets/hr/grades.xml'</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Query" type="evt:QueryComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Structure used to describe the query associated with a search event.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="ResultPage" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Details of the page (or sub-set) of results actually displayed/returned to the user, if known at query time.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Details of the page (or sub-set) of results actually displayed/returned to the user, if known at query time.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="TotalPages" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The number of pages/sets that make up the complete result set.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="PerPage" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The maximum number of results that will be displayed per page. E.g. 10 results per page.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="PageNumber" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The number of the page/set of results displayed/returned to the user, e.g. 3 out of 24 pages.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="From" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The index of the first result in the page out of the full result set (inclusive), e.g. 11 (in the case of showing results 11-20 of 453)</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="To" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The index of the last result in the page out of the full result set (inclusive), e.g. 20 (in the case of showing results 11-20 of 453)</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="TotalResults" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The total number of results returned by the query, if known at query time. In situations where only a sub-set of results are displayed/returned to the user then this element represents the count of ALL results and ResultPage should be used to provide details of which results are actually viewed/returned by the user.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Results" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the results returned by the search if they are known at the time of the Search event (a synchronous search). If the results are not know at execution time (an asynchronous search) and will be viewed as part of a separate event then View/SearchResults can be used to model that event.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:group>
  <xs:group name="MultiObjectGroup">
    <xs:choice>
      <xs:element name="Association" type="evt:AssociationComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the association or link between two or more entities, e.g. the link between two web resources.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Banner" type="evt:BannerComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes a banner or message presented to a user, e.g. an acceptable use policy message shown on system login.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Chat" type="evt:ChatComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes part of a chat session between a user and one or more other users, e.g. in an instant messaging application.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Configuration" type="evt:ConfigurationComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the configuration of entity, e.g. it can be used to describe the update to the configuration of a network device.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Criteria" type="evt:CriteriaComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Structure used to describe a criteria used to filter or limit the scope of something, e.g. in a search, view, update or delete event.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Document" type="evt:DocumentComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes a document that may be stored electronically or in hard-copy form.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Email" type="evt:EmailComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes an email sent from one user to one or more recipients.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="File" type="evt:FileComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A file object, e.g. a text file on file system</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Folder" type="evt:FolderComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A folder object, e.g. a directory or folder on file system.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Group" type="evt:GroupComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A group entity, e.g. a user group, an access control group or a named group of some kind that ties together a collection of entities/objects of some kind.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="GroupChat" type="evt:GroupChatComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the details of a chat event within a chat room or group.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Object" type="evt:ObjectComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A generic object or entity that cannot be described using any of the other more specific object types.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="SearchResults" type="evt:SearchResultsComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A set of search results from a query where the results are viewed or interacted with in a separate event to the execution of the query. E.g. for long-running queries where the results are stored for later viewing/processing. The Search schema action should be used to describe the event for the execution of the search. Query/Id or Query/Name can be used to associate the results event with the query event.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Shortcut" type="evt:ShortcutComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A shortcut to another file/object, such as a Windows Shortcut or linux symbolic link.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="User" type="evt:UserComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A user entity which may represent a person or some form of non-human processing user.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="VirtualSession" type="evt:VirtualSessionComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>This is used to describe the session used when viewing another user's session, e.g. screen sharing or remote assistance type activities.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="VOIP" type="evt:VOIPComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes a Voice Over Internet Protocol call.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Resource" type="evt:ResourceComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>This is used to describe a resource within a website or web application, such as an HTML file, image file or script, along with the details of that resource such as size or response codes.  It can represent both successful and failed access to the resource object.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:choice>
  </xs:group>
  <xs:group name="InstallationGroup">
    <xs:sequence>
      <xs:choice minOccurs="1" maxOccurs="1">
        <xs:element name="Software" type="evt:SoftwareComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Description of the software that was installed/uninstalled.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Hardware" type="evt:HardwareComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Description of the hardware that was installed/uninstalled.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Media" type="evt:MediaComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Description of the media that was installed/uninstalled.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:choice>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The outcome of the (un)installation.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:group>
  <xs:group name="SendReceiveGroup">
    <xs:sequence>
      <xs:element name="Source" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The initiator(s) of the object or resource sent or received. An initiator can be a user and/or device.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>The initiator(s) of the object or resource sent or received. An initiator can be a user and/or device.</xs:documentation>
          </xs:annotation>
          <xs:choice minOccurs="1" maxOccurs="unbounded">
            <xs:element name="User" type="evt:UserComplexType" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The user that sent the payload.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Device" type="evt:DeviceComplexType" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The device that sent the payload.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:choice>
        </xs:complexType>
      </xs:element>
      <xs:element name="Destination" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The destination(s) of the object or resource sent or received. A destination can be a user and/or device.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>The destination(s) of the object or resource sent or received. A destination can be a user and/or device.</xs:documentation>
          </xs:annotation>
          <xs:choice minOccurs="1" maxOccurs="unbounded">
            <xs:element name="User" type="evt:UserComplexType" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The user that the payload is being sent to</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Device" type="evt:DeviceComplexType" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The device that the payload is being sent to</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:choice>
        </xs:complexType>
      </xs:element>
      <xs:element name="Payload" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>If the network action is related to message transfer from one place to another then this element describes the message.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:group>

  <!-- Complex Types -->

  <xs:complexType name="AccessControlGroupsComplexType">
    <xs:annotation>
      <xs:documentation>Describes a set of groups used to control access to protectively marked items.</xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="AccessControlGroup" type="xs:string" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>The name of an access control group that is used to control access to protectively marked items. E.g. 'HR', 'Auditors', 'Management', etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ActivityComplexType">
    <xs:annotation>
      <xs:documentation>Type that describes relationships between different events. For example in an asynchronous search the viewing of the results of the search may be a separate event from the execution of the query. In this instance the view event would be a child of the execution event.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Id" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The unique identifier of the event that is being referenced. This will be the value of Event/EventSource/EventId on the referenced event. E.g. where an event with Event/EventSource/EventId=101 is a child of an event with Event/EventSource/EventId=99, the value in this element would be 99.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A descriptive name for the referenced event.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Parent" type="evt:ActivityComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The details of the event that is the parent of this referenced event. E.g. if event C is a child of event B which is a child of event A, this element would record an Id of A.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="AlertComplexType">
    <xs:annotation>
      <xs:documentation>Type that describes and alert of some kind, e.g. an alert generated by an intrusion detection system, malware scanner, virus scanner, etc.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Type" type="evt:AlertTypeSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The type of alert that has been fired, e.g. Error, Malware, etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Severity" type="evt:AlertSeveritySimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The severity of the alert.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Priority" type="evt:AlertPrioritySimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The priority of the alert.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Subject" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the event or rule that fired or vulnerability or malware that has been scanned for or found.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The descriptive message for the alert.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="IDS" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Information about an IDS generated event.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Information about an IDS generated event.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Rule" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The type of IDS event or rule that fired.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Source" type="evt:NetworkLocationComplexType" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The source network device involved in the IDS event.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Destination" type="evt:NetworkLocationComplexType" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The destination network device involved in the IDS event.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Payload" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>Details about the payload being transmitted between the source and destination devices.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Malware" type="evt:AntiMalwareThreatComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Type that describes a threat identified by an anti-malware scanner.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Network" type="evt:NetworkComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A type to describe part of a computer network or some activity on a network.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Change" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Any events to do with monitoring the status of files should use this element.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Information about an IDS generated event.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Action" type="evt:ChangeActionSimpleType" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The action performed by the file monitor, e.g. starting to scan files for changes, or the detection of a file change.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Before" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>Describes the last known state of the file before it was altered.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="After" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>Describes the new state of the file now it has changed.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Rule" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The file monitoring rule that was fired to generate this event.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="AndComplexType">
    <xs:annotation>
      <xs:documentation>All of the enclosed items are to be treated as being AND together.</xs:documentation>
    </xs:annotation>
    <xs:group ref="evt:AdvancedQueryOperatorGroup" minOccurs="0" maxOccurs="unbounded"/>
  </xs:complexType>
  <xs:complexType name="AntiMalwareThreatComplexType">
    <xs:annotation>
      <xs:documentation>Type that describes a threat identified by an anti-malware scanner.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Product" type="evt:SoftwareComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the anti-malware product used.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Signature" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the anti-malware signature used.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Describes the anti-malware signature used.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The version of the signature.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Updated" type="evt:DateTimeSimpleType" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>When the signature was last updated.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Threat" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the threat if one has been found.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Describes the threat if one has been found.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Category" type="evt:ThreatCategorySimpleType" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The category of the threat, e.g. Worm, Virus, etc.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The name of the threat, e.g. a virus name.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Infected" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the infected item if one has been found.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit. Can also be used for appending data about the event after it has been received or processed, e.g. for recording details relating to the processing of the event such as the feed name.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="AnyContentComplexType" mixed="true">
    <xs:annotation>
      <xs:documentation>This type is used to contain any content conforming to an agreed format/specification that is defined outside this XML Schema.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:any minOccurs="0" processContents="lax"/>
    </xs:sequence>
    <xs:attribute name="ContentType" type="xs:string">
      <xs:annotation>
        <xs:documentation>String to describe the format type and specification of the content, e.g. JSON or XML. The valid values are defined outside this XML Schema.</xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="Version" type="xs:string">
      <xs:annotation>
        <xs:documentation>Defines the version of data structure specification.</xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="Id" type="xs:string">
      <xs:annotation>
        <xs:documentation>An identifier, name or key to distinguish this block of content from others in the document. It can either be globally unqiue, unique within the document or unique within its siblings.</xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>
  <xs:complexType name="ApprovalComplexType">
    <xs:annotation>
      <xs:documentation>This type describes an approval (or rejection) event in a workflow, e.g a workflow where a more privileged user is required to approve the work of another user.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Action" type="evt:ApprovalActionSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action that the approval event is capturing, e.g. Approve, Reject, etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>An identifier associated with the approval step/process.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Subject" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The object that this approval step (or request for approval) relates to, e.g. the document being approved.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Requestors" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The user(s) that requested the approval, e.g. jbloggs requesting approval from a manager for his finance report.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>The user(s) that requested the approval, e.g. jbloggs requesting approval from a manager for his finance report.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Requestor" type="evt:UserComplexType" minOccurs="1" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>A user that requested the approval, e.g. jbloggs requesting approval from a manager for his finance report.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Approvers" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The user(s) that are providing the approval, e.g. a user requesting approval from manager fsmith for his finance report.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>The user(s) that are providing the approval, e.g. a user requesting approval from manager fsmith for his finance report.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Approver" type="evt:UserComplexType" minOccurs="1" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>The user that is providing the approval, e.g. a user requesting approval from manager fsmith for his finance report.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Reason" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The reason for the approval/rejection/request, e.g. why the approval was rejected.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="AssociationComplexType">
    <xs:annotation>
      <xs:documentation>This type describes the association or linking of a number of objects. For example, it may describe the link between two web resources.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Objects" type="evt:MultiObjectComplexType" minOccurs="1" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The objects that have some form of link or association</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="AuthenticateComplexType">
    <xs:annotation>
      <xs:documentation>Used to record authentication events such as logon and logoff. All authentication events that originate from a client device should record details of the client device in the event source.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Action" type="evt:AuthenticateActionSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The authentication action that was performed, e.g. Logon, Logoff.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="LogonType" type="evt:AuthenticateLogonTypeSimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>This indicates the type of logon. For example, Microsoft Windows has several logon types such as Interactive (logon to domain), RemoteInteractive (logon to remote machine), CachedInteractive (logon to local machine using cached domain information due to loss of network).</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:choice minOccurs="1" maxOccurs="1">
        <xs:element name="User" type="evt:UserComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The user who the authentication action relates to.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Device" type="evt:DeviceComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Where a device authenticates with another device, this is the device that initiates the authentication action.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Group" type="evt:GroupComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The group the authentication action relates to.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:choice>
      <xs:element name="Outcome" type="evt:AuthenticateOutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="AuthenticateOutcomeComplexType">
    <xs:annotation>
      <xs:documentation>Used to describe the outcome of an authentication event, including the reason for any failure.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseOutcomeComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Reason" type="evt:AuthenticateOutcomeReasonSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>An enumeration used to describe the reason why authentication failed.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="AuthoriseComplexType">
    <xs:annotation>
      <xs:documentation>Describes event actions related to account management such as adding and removing user and system accounts. It can also describe event actions related to the request for authorisation, e.g. when a user is checked against a set of permissions for the data/entities they are trying to access.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:group ref="evt:MultiObjectGroup" minOccurs="1" maxOccurs="unbounded"/>
      <xs:element name="Action" type="evt:AuthorisationSimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The type of the event action, e.g. a modification to authorisation rules/groups or the request to be authorised.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="AddGroups" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A list of roles or permissions that have been added to an object.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>A list of roles or permissions that have been added to an object.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Group" type="evt:GroupComplexType" minOccurs="0" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>A role or permission that has been added to an object.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="RemoveGroups" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A list of roles or permissions that have been removed from an object.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>A list of roles or permissions that have been removed from an object.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Group" type="evt:GroupComplexType" minOccurs="0" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>A role or permission that has been removed from an object.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="BannerComplexType">
    <xs:annotation>
      <xs:documentation>Structure used to describe a banner presented to a user. Typically, it displays legal information relating to the system.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>If the text of the banner is versioned then this records the version of the banner that is displayed to the user.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Message" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The message text displayed on the banner.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="BaseChatComplexType" abstract="true">
    <xs:annotation>
      <xs:documentation>Describes the details of a chat event, e.g. an instance message chat message from one user to another.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="SessionId" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The ID for the chat session.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Room" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The name of the chat room or group.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="From" type="evt:UserComplexType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The user that initiated the chat event.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="To" type="evt:UserComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>The user(s) that the chat event (or message) is directed at.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Content" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The chat message or content sent by the user.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="BaseFileComplexType" abstract="true">
    <xs:annotation>
      <xs:documentation>A base type to describe a file object, e.g. a text file on file system</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Path" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The full system file path.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Created" type="evt:DateTimeSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The creation time of the file.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Modified" type="evt:DateTimeSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The modification time of the file.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Accessed" type="evt:DateTimeSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The last access time of the file.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Size" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The size of the file in bytes.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Media" type="evt:MediaComplexType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>Optional description of the media that the file exists on or that the file is being written to.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Hash" minOccurs="0" maxOccurs="unbounded" type="evt:HashComplexType">
            <xs:annotation>
              <xs:documentation>Describes the output of a hash function and the type of has function used.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="BaseNetworkComplexType" abstract="true">
    <xs:annotation>
      <xs:documentation>A base type to describe part of a computer network or some activity on a network.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Source" type="evt:NetworkLocationComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The source device that is attempting the network action.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Destination" type="evt:NetworkLocationComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The destination device for the network action.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="ProcessName" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the process responsible for the network action.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Payload" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>If the network action is related to message transfer from one place to another then this element describes the message.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Rule" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The network boundary filter rule that was fired to generate this event.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="BaseObjectComplexType" abstract="true">
    <xs:annotation>
      <xs:documentation>A base type for describing some kind of object or entity.</xs:documentation>
    </xs:annotation>
    <xs:group ref="evt:BaseObjectGroup" minOccurs="1" maxOccurs="1"/>
  </xs:complexType>
  <xs:complexType name="BaseObjectOutcomeComplexType" abstract="true">
    <xs:annotation>
      <xs:documentation>Contains an item of data, e.g. a file, document, etc, and describes the outcome of the event as well as providing for additional event data that does not fit into the item of data element.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:group ref="evt:MultiObjectGroup" minOccurs="1" maxOccurs="unbounded"/>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="BaseOutcomeComplexType" abstract="true">
    <xs:annotation>
      <xs:documentation>Describes the outcome of an event whether it is successful and whether it was permitted.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Success" type="xs:boolean" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>If the outcome of an event was successful then 'true', 'false' otherwise. Can be omitted if true as this is the default. The main exception to this default would be if there were many varied Descriptions for the success criteria and such Descriptions could provide additional context to the event.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Permitted" type="xs:boolean" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>If an action was permitted then 'true', 'false' otherwise. Can be omitted if true as this is the default. The main exception to this default would be if there were many varied Descriptions for the success criteria and such Descriptions could provide additional context to the event.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="AuthService" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A description of the authorisation service that was used to decide if the action was permitted.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>A description of the authorisation service that was used to decide if the action was permitted.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>An identifier for the authorisation service, usually a URI string.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="CacheTimeout" type="xs:positiveInteger" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The number of seconds a system is allowed to cache this authorisation before it needs to be checked again.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Human readable text that describes the outcome.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ChatComplexType">
    <xs:annotation>
      <xs:documentation>Describes the details of a chat event, e.g. an instance message chat message from one user to another.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseChatComplexType"/>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="ClassificationComplexType">
    <xs:annotation>
      <xs:documentation>Describes the classification and access controls for an item such as a document, record, file, etc.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Text" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Optional full human-readable text of the protective marking that can combine the various elements in this Classification structure, e.g 'Commercial in Confidence'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Originator" type="evt:OrganisationComplexType" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The originator or creator of the protectively marked item. The originator is described by an Organisation and optionally qualified by the organisation's Country.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Custodian" type="evt:OrganisationComplexType" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The custodian or owner of the protectively marked item. The custodian is responsible for the lifecycle of the marked item. The custodian is described by an Organisation and optionally qualified by the organisation's Country.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Classification" type="xs:string" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The classification of the protectively marked item. E.g. 'OFFICIAL', 'COMMERCIAL IN CONFIDENCE', 'CONFIDENTIAL', 'INTERNAL' etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Descriptors" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Additional descriptors or keywords to further qualify the Classification e.g. 'PERSONAL'</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Additional descriptors or keywords to further qualify the Classification e.g. 'PERSONAL'</xs:documentation>
          </xs:annotation>
          <xs:sequence>
            <xs:element name="Descriptor" type="xs:string" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>Descriptor or keyword to further qualify the Classification e.g. 'PERSONAL'</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="OrGroups" type="evt:AccessControlGroupsComplexType" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The groups that a person must belong to AT LEAST ONE OF in order to be permitted to access the protectively marked item. E.g. 'HR' OR 'Auditors'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="AndGroups" type="evt:AccessControlGroupsComplexType" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The groups that a person must belong to ALL OF in order to be permitted to access the protectively marked item. E.g. 'Sales' AND 'Management'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="PermittedNationalities" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The nationalities of people permitted to access this protectively marked item. E.g. 'GBR', 'USA'</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>The nationalities of people permitted to access this protectively marked item. E.g. 'GBR', 'USA'</xs:documentation>
          </xs:annotation>
          <xs:sequence>
            <xs:element name="Nationality" type="evt:CountryTrigraphSimpleType" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>An ISO 3166 alpha-3 trigraph for a nationality permitted to view this protectively marked item. E.g. 'GBR'.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="PermittedOrganisations" minOccurs="0">
        <xs:annotation>
          <xs:documentation>The organisations permitted to access the protectively marked item.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>The organisations permitted to access the protectively marked item.</xs:documentation>
          </xs:annotation>
          <xs:sequence>
            <xs:element name="PermittedOrganisation" type="evt:OrganisationComplexType" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>An organisation permitted to access the protectively marked item. The PermittedOrganisation is described by an Organisation and optionally qualified by the organisation's country code.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="DisseminationControls" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Controls governing the onward handling of the protectively marked item</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Controls governing the onward handling of the protectively marked item</xs:documentation>
          </xs:annotation>
          <xs:sequence>
            <xs:element name="DisseminationControl" type="xs:string" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>A policy or control governing the onward handling of a protectively marked item. E.g. ORIGINATOR_CONTROLLED</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Disposition" minOccurs="0">
        <xs:annotation>
          <xs:documentation>Describes the timescale and process for the disposal of the protectively marked item</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Describes the timescale and process for the disposal of the protectively marked item</xs:documentation>
          </xs:annotation>
          <xs:sequence>
            <xs:element name="Date" type="evt:DateTimeSimpleType">
              <xs:annotation>
                <xs:documentation>Date/time that the disposition process must be enacted by</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Process" type="xs:string">
              <xs:annotation>
                <xs:documentation>The action to be taken on expiry of the disposition date. E.g. 'DELETE' to delete the item.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ConfigurationComplexType">
    <xs:annotation>
      <xs:documentation>Describes the configuration of entity, e.g. it can be used to describe the update to the configuration of a network device.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="CoordinatesComplexType">
    <xs:annotation>
      <xs:documentation>The geographic coordinates of the location (i.e. the latitude/longitude).</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Latitude" type="evt:LatitudeSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Geographic coordinate specifying the north/south position on the earth's surface, expressed as decimal degrees from the equator (0). -90 (South) to +90 (North).</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Longitude" type="evt:LongitudeSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Geographic coordinate specifying the east/west position on the earth's surface, expressed as decimal degrees from the Greenwich Meridian (0). -180 (West) to +180 (East).</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="CopyComplexType">
    <xs:annotation>
      <xs:documentation>Describes an event action relating to copying data, files, documents, etc.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Source" type="evt:MultiObjectComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The source of the data being copied.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Destination" type="evt:MultiObjectComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The destination for the data being copied.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Outcome" type="evt:CopyMoveOutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the copy was successful. If omitted it is assumed that the copy was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="CopyMoveOutcomeComplexType">
    <xs:annotation>
      <xs:documentation>Used to describe the outcome of a copy or move event, including the reason for any failure.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseOutcomeComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Reason" type="evt:CopyMoveOutcomeReasonSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>Used to explain the reason for failure, e.g. Device full.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="CreateComplexType">
    <xs:annotation>
      <xs:documentation>Describes an event action relating to creating data, files, documents, etc.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectOutcomeComplexType"> </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="CriteriaComplexType">
    <xs:annotation>
      <xs:documentation>Structure used to describe a criteria used for search, view, update or delete.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:group ref="evt:CriteriaExtensionGroup" minOccurs="1" maxOccurs="1"/>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="DataComplexType">
    <xs:annotation>
      <xs:documentation>Describes any other event data that does not fit into a schema element but may be useful for the purpose of audit. The recursive nature of this type means it can be used to model a tree of data.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>A child data item that may itself have descendants.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
    <xs:attribute name="Name" type="xs:string" use="required">
      <xs:annotation>
        <xs:documentation>The name of the data item. The taxonomy of the data items may be defined by the system sending the events or defined centrally for all systems to use.</xs:documentation>
      </xs:annotation>
    </xs:attribute>
    <xs:attribute name="Value" type="xs:string" use="optional">
      <xs:annotation>
        <xs:documentation>The simple string value for the data item.</xs:documentation>
      </xs:annotation>
    </xs:attribute>
  </xs:complexType>
  <xs:complexType name="DeviceComplexType">
    <xs:annotation>
      <xs:documentation>Describes a device, e.g. a workstation, server or item of network infrastructure.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Identifier used to uniquely identify the device within the organisation's asset register/system. Also, this can be used to identify a device that does not have HostName/IPAddress/MACAddress.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A descriptive name of the device, e.g. 'Sun Fire X4600', 'HP LaserJet 4+'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Classification" type="evt:ClassificationComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The security classification associated with this device.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="HostName" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The network host name of the device, e.g. someserver.somenet.org.uk. Ideally this field should always contain a fully qualified DNS name of the host.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="IPAddress" type="evt:IPAddressSimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The network IP address of the device, e.g. 192.168.0.3. Ideally this should always be supplied.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="MACAddress" type="evt:DeviceMACAddressSimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The Media Access Control (MAC) address of the device.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Port" type="evt:PortSimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The network port that is being used on the device, e.g. 443.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Location" type="evt:LocationComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the geographic location of the device.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="DeleteComplexType">
    <xs:annotation>
      <xs:documentation>Describes an event action relating to deleting data, files, documents, etc.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectOutcomeComplexType"> </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="DocumentComplexType">
    <xs:annotation>
      <xs:documentation>Describes a document that may be stored electronically or in hard-copy form.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Title" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The title or name of the document.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Reference" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>A unique code or ID that can be used to reference the document.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The version or iteration of the document, e.g. v13 or v1.3.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Path" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The path that defines the location of the document on a file system or document management system, e.g. '/some/path/to/the/document.pdf'</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Created" type="evt:DateTimeSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The date that the document was created.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Modified" type="evt:DateTimeSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The date that the document was last modified.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Accessed" type="evt:DateTimeSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The date that the document was last accessed.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Pages" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The number of pages in the document.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Size" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The size of the document in bytes.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="EmailComplexType">
    <xs:annotation>
      <xs:documentation>Describes an email sent from one user to one or more recipients.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="From" type="evt:UserComplexType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The user that sent the email.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="To" type="evt:UserComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>The user(s) and/or distribution group(s) that the email was sent to.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Cc" type="evt:UserComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>The user(s) and/or distribution group(s) that the email was CC'd (carbon copied) to.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Bcc" type="evt:UserComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>The user(s) and/or distribution group(s) that the email was BCC'd (blind carbon copied) to.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Subject" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The subject text of the email.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Content" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The content of the email, i.e. the message body. This may be plain text or some form of rich text like HTML.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="MimeType" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The MIME (Multipurpose Internet Mail Extensions) type of the email body, i.e. the format of the message body, e.g. 'text/plain' or 'text/html'. </xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element minOccurs="0" name="Date" type="xs:string">
            <xs:annotation>
              <xs:documentation>The date taken from the email 'Date' header. This date is in string form and in the format and timezone as produced by the email client. It may be local time or UTC depending on the client, therefore it may differ to the EventTime of this event. It is also possible it is invalid if the email client device is misconfigured, e.g. in the future.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="EventChainComplexType">
    <xs:annotation>
      <xs:documentation>This type can be used to create relationships between different events, i.e. where one event is the child of another.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Activity" type="evt:ActivityComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The event that this event has a relationship to or is referenced by.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="EventDetailComplexType">
    <xs:annotation>
      <xs:documentation>This type describes the details of what happened in the event: the type of the event, why it happened and the event action.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="TypeId" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A name/code/ID to uniquely identify the logical event type within the service providing the events. E.g. a Windows eventId (i.e. representing 'Failed logon', 'Change password attempt', etc.) or for application logging: SaveRecord, ViewUserRecord, ViewSearchResults, etc. The granularity will depend on the application. Typically, the number of unique TypeIds will be in the 10s. Note, the values of the TypeId are not meant to be globally consistent, they will only be relevant within that service providing the events.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Some human-readable descriptive text for the event type.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Purpose" type="evt:PurposeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The purpose/justification assigned to this event for user actions that are required to be justified for reasons of corporate policy, e.g. transferring data to removable media, viewing personnel records or making a high value payment.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:choice minOccurs="1" maxOccurs="1">
        <xs:element name="Authenticate" minOccurs="1" maxOccurs="1" type="evt:AuthenticateComplexType">
          <xs:annotation>
            <xs:documentation>Used to record authentication events such as logon and logoff. Also used for recording authentication by physical access controls, e.g. doors/turnstiles. All authentication events that originate from a client device should record details of the client device in the event source.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Authorise" minOccurs="1" maxOccurs="1" type="evt:AuthoriseComplexType">
          <xs:annotation>
            <xs:documentation>All events related to account management such as adding and removing user and system accounts.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Search" type="evt:SearchComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Any events related to searching for data should use this element.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Copy" type="evt:CopyComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>All events related to copying data, files, documents, etc. should use this element.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Move" type="evt:MoveComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>All events related to moving data should use this element.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Create" type="evt:CreateComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>All events related to creating data should use this element.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="View" type="evt:ViewComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>All events related to viewing data should use this element. Note that viewing data is subtly different from reading data. This event is to be used when data is displayed to an end user and not for data read by an application.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Import" type="evt:ImportComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>All events related to importing data should use this element. An import could include any batch insert of data from an external source or uploading a file.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Export" type="evt:ExportComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>All events related to exporting data should use this element. An export could include activities such as downloading data from an application or generating a report.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Update" minOccurs="1" maxOccurs="1" type="evt:UpdateComplexType">
          <xs:annotation>
            <xs:documentation>All events related to updating data should use this element.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Delete" type="evt:DeleteComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>All events related to deleting data should use this element.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Process" minOccurs="1" maxOccurs="1" type="evt:ProcessComplexType">
          <xs:annotation>
            <xs:documentation>Whenever processes such as applications or services are started, stopped etc., this should be recorded in this element. It also covers the running of batch processes or jobs.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Print" minOccurs="1" maxOccurs="1" type="evt:PrintComplexType">
          <xs:annotation>
            <xs:documentation>All events related to printing should use this element.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Install" type="evt:InstallComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Details about installation of either hardware or software.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Uninstall" type="evt:UninstallComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Details about removal of either hardware or software.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Network" minOccurs="1" maxOccurs="1" type="evt:NetworkEventActionComplexType">
          <xs:annotation>
            <xs:documentation>Any events related to network traffic, filtering or access should be recorded using this element.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Alert" minOccurs="1" maxOccurs="1" type="evt:AlertComplexType">
          <xs:annotation>
            <xs:documentation>An alert event according to the system producing the event, e.g. an event raised when an anti-malware system finds malware.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Send" type="evt:SendComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Used for send events that are at a higher level than a network/send event, e.g. sending an email</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Receive" type="evt:ReceiveComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Used for receive events that are at a higher level than a network/receive event, e.g. receiving an email</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Approval" type="evt:ApprovalComplexType" minOccurs="1" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>Any events relating to the action of approving/accepting or rejecting something, e.g. an approval step in a workflow, accepting a license agreement, or acceptable use policy. The event may relate to one user approving the work/action of another user or a single user accepting something.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Unknown" minOccurs="1" maxOccurs="1" type="evt:UnknownComplexType">
          <xs:annotation>
            <xs:documentation>This element should be used were the type of the event cannot be described by any of the other event actions, or the event type is unknown.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:choice>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="EventSourceComplexType">
    <xs:annotation>
      <xs:documentation>Details where the event came from, i.e. what generator created the event and on what device.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="EventId" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A unique identifier known to the source system that created the event. This identifier may not be unique outside the source system. It can be used for linking related events within the source system, e.g. where an event is part of a chain of events or is child of another event. Linking of events can be recorded with the Event/EventChain element.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="SessionId" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Where an event is part of a session the identifier for that session can be recorded here to allow subsequent grouping of events for the same session. The SessionId should be a unique identifier for the session within the source system. It is not expected that the SessionId have meaning or be unique outside the source system.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="System" type="evt:SystemComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The system that generated the event. This is not the same as the generator as the generator is merely the application or component that created the event, e.g. auditd. The system describes the higher level project/service or capability that uses the generator as a component, e.g. 'Payroll System'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Generator" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The thing that generated the event. This could be the name of an application, service or OS entity. Multiple devices may host the same generator, e.g. many copies of the same OS. The event type within the event description will describe an event that is unique to the generator, i.e. the generator is treated as a namespace for event type ids.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Device" type="evt:DeviceComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A description of the device that the event generator is hosted upon.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Client" type="evt:DeviceComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>In situations where an event has been created as a result of an interaction with a client device, the client should be recorded. This will be the case for web applications that are responding to input from users with active sessions. All authentication events that originate from a connected client should populate this element.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Server" type="evt:DeviceComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>In situations where an event has been created as a result of an interaction with a server device, the server should be recorded.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Door" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Physical access events are generated by doors, barriers, turnstiles, etc. This element provides details of the door and its location and access control properties.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Physical access events are generated by doors, barriers, turnstiles, etc. This type provides details of the door and its location and access control properties.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The site-wide name/identifier for the door.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>A user readable description of the door.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Location" type="evt:LocationComplexType" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>Describes the geographic location of the device.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="SingleEntry" type="xs:boolean" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>It is assumed that doors only allow for a single authenticated person to enter at a time, e.g. in the case of turnstiles. Where single entry is true this element can be omitted as this is expected by default.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="RemoveAll" type="xs:boolean" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>This element is used to tell us to remove all access zones from the list of currently accessible zones for a user before adding a new one. This is the case whenever a user moves from one zone to another and loses all possible access to the zones they were previously in, i.e. they would need to re-authenticate to regain access rather than just pass back through the door. If not specified this element is considered to be true as most movement through a door removes access to previously accessible zones. Removal of all access zones provides anti pass-back protection.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="AddAccess" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>A list of access zones that have been added by this event assuming it is successful. For example if a person successfully enters a building at door A, the system then adds the access zone for room X within that building which ensures the person must have correctly entered the building at door A before being able to access room X.</xs:documentation>
              </xs:annotation>
              <xs:complexType>
                <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="AccessZone" type="xs:string" minOccurs="1" maxOccurs="unbounded">
                    <xs:annotation>
                      <xs:documentation>An area within a building that is accessible only via an authenticated access method, e.g. a turnstile or door with an access control system.</xs:documentation>
                    </xs:annotation>
                  </xs:element>
                </xs:sequence>
              </xs:complexType>
            </xs:element>
            <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit. Can also be used for appending data about the event after it has been received or processed, e.g. for recording details relating to the processing of the event such as the feed name.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="User" type="evt:UserComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Where events are created as a result of a user action or within the context of a user account, the user should be recorded. To achieve this it may be necessary to map the user identifier in an application to a common user identifier when populating this element. Where an identifier exists that is unique across the organisation, such as a distinguished name (User DN) from a certificate authority or directory service, then this should be used in the &lt;Id&gt; element in preference to any other user identifier.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="RunAs" type="evt:UserComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>In some cases an account may switch to another account in order to run a process or perform a privileged action, e.g. use of sudo. Where this happens the &lt;User> element should still refer to the real user and this element should indicate what the temporary user was when the event was created, e.g. root. This is also often used when a system user (processing account) executes scheduled jobs on behalf of the real user that scheduled the job. Where an identifier exists that is unique across the organisation, such as a distinguished name (User DN) from a certificate authority or directory service, then this should be used in the &lt;Id&gt; element in preference to any other user identifier.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Interactive" type="xs:boolean" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Indicates whether the event was produced as a result of direct interaction, i.e. user was directly responsible for the event being created and was present at the time it was created. This element will be false where an event may have been created after the user was present, e.g. where scheduled processing is performed or an action has been queued for execution later, as is the case when some form of asynchronous processing is used. All interactive events must provide the Id for the user. Can be omitted if true as this is the default.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="EventTimeComplexType">
    <xs:annotation>
      <xs:documentation>Describes the time the event was created.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="TimeCreated" type="evt:DateTimeSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>This element contains information about the time the event was created.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="TimeSource" type="evt:DeviceComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>This is an optional element to be used to indicate the time source that the event creation time has been synchronised with. In most circumstances it is assumed that the event time has been synchronised with the corporate time service where the generating device resides so the inclusion of this element is not required.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit. Can also be used for appending data about the event after it has been received or processed, e.g. for recording details relating to the processing of the event such as the feed name.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ExportComplexType">
    <xs:annotation>
      <xs:documentation>Captures data relevant to an export operation.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Source" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The source of the data being exported.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Destination" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The destination for the data being exported.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the export was successful. If omitted it is assumed that the export was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="FileComplexType">
    <xs:annotation>
      <xs:documentation>A type to describe a file object, e.g. a text file on file system</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseFileComplexType"/>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="FolderComplexType">
    <xs:annotation>
      <xs:documentation>Describes a folder object, e.g. a directory or folder on file system.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseFileComplexType"/>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="GroupChatComplexType">
    <xs:annotation>
      <xs:documentation>Describes the details of a chat event within a chat room or group.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseChatComplexType"/>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="GroupComplexType">
    <xs:annotation>
      <xs:documentation>A group entity, e.g. a user group, an access control group or a named group of some kind that ties together a collection of entities/objects of some kind.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="GroupsComplexType">
    <xs:annotation>
      <xs:documentation>Describes a collection of group entities, e.g. user groups or access control groups.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Group" type="evt:GroupComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>One or more group entities, e.g. user groups or access control groups.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="HardwareComplexType">
    <xs:annotation>
      <xs:documentation>Used to describe a hardware item that may be added or removed from a system.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Type" type="evt:HardwareTypeSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The type of hardware, e.g. hard disk drive.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A unique identifier for the piece of hardware, e.g. an asset number.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A friendly name for the hardware, e.g. a name that has been defined in an asset management or device monitoring system.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Model" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The model name as defined by the manufacturer.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Manufacturer" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The manufacturer of the piece of hardware.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Capacity" type="xs:positiveInteger" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The capacity of the device in bytes.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="HashComplexType">
    <xs:annotation>
      <xs:documentation>Describes the output of a hash function and the type of has function used.</xs:documentation>
    </xs:annotation>
    <xs:simpleContent>
      <xs:extension base="xs:string">
        <xs:annotation>
          <xs:documentation>The value obtained from applying a hash function (e.g. MD5, SHA-256, etc.) to the contents of the file.</xs:documentation>
        </xs:annotation>
        <xs:attribute name="Type" type="xs:string" use="optional">
          <xs:annotation>
            <xs:documentation>The type of hashing algorithm used, e.g. MD5, SHA-256, etc.</xs:documentation>
          </xs:annotation>
        </xs:attribute>
      </xs:extension>
    </xs:simpleContent>
  </xs:complexType>
  <xs:complexType name="ImportComplexType">
    <xs:annotation>
      <xs:documentation>Captures data relevant to an import operation, e.g. importing a file from outside an application into the application.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Source" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The source of the data being imported.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Destination" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The destination for the data being imported.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the import was successful. If omitted it is assumed that the import was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="InstallComplexType">
    <xs:annotation>
      <xs:documentation>Describes the installation of either hardware or software.</xs:documentation>
    </xs:annotation>
    <xs:group maxOccurs="1" minOccurs="1" ref="evt:InstallationGroup"/>
  </xs:complexType>
  <xs:complexType name="LocationComplexType">
    <xs:annotation>
      <xs:documentation>Describes the geographic location of the device.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Country" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The ISO-3166 country short name, e.g. 'UNITED KINGDOM OF GREAT BRITAIN AND NORTHERN IRELAND' or 'ANDORRA'</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="State" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The location State or Province.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="City" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The location City.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Town" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The location Town.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Site" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the site of the location, e.g. where an organisation has multiple distinct sites or campuses. Specifying the site is particularly important when the sites are in the same town/city.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:sequence minOccurs="0" maxOccurs="1">
        <xs:element name="Building" type="xs:string" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The name of the building.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Floor" type="xs:string" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The floor of the building that the location refers to.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Room" type="xs:string" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The identifier (e.g. name) of the room that the location refers to.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:choice minOccurs="1" maxOccurs="1">
          <xs:element name="Desk" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The identifier (e.g. name) of the desk that the location refers to.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Rack" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The identifier for the rack/cabinet where the location refers to a rack mounted device, e.g. a rack mounted 4U server in a cabinet.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Position" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The position of the device where the location refers to a rack mounted device in a rack/cabinet. E.g. where a 4U device occupies U positions 1-4 in a cabinet (numbered from the bottom of the cabinet, starting from 1), the position would be '1'.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:choice>
      </xs:sequence>
      <xs:element name="TimeZoneName" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The timezone name for the location as defined by the IANA Timezone Database (https://www.iana.org/time-zones), e.g. 'Europe/London' or 'Australia/NSW'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Coordinates" type="evt:CoordinatesComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The geographic coordinates of the location (i.e. the latitude/longitude).</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="AccessZone" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of a zone within a building or site with some form of access control/monitoring for entry/exit to the zone.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit. Can also be used for appending data about the event after it has been received or processed, e.g. for recording details relating to the processing of the event such as the feed name.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="MediaComplexType">
    <xs:annotation>
      <xs:documentation>Used to describe media added or removed from a computer system, or as a location for reading and writing files.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Type" type="evt:MediaTypeSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The type of the removable media, e.g. MemoryCard</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The identifier for the removable media. This may be an identifier provided by the media (e.g. the Card Identification or CID of an SD card) or assigned by device monitoring software.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A friendly name for the media, possibly assigned by device monitoring system..</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Removable" type="xs:boolean" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Indicates if this media is removable, e.g. USB storage device or soft media such as DVD.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="ReadWrite" type="xs:boolean" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Indicates if a device has read-write access. Most devices are read-write so this is assumed to be true and can therefore be omitted where this is the case.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Capacity" type="xs:positiveInteger" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The capacity of the media in bytes.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Classification" type="evt:ClassificationComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The classification of the media.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="MetaDataTagsComplexType">
    <xs:annotation>
      <xs:documentation>Metadata tags that can be used for additional object tagging or categorisation. Object tagging allows for the labelling (or filtering) of objects using words that label, categorise or group similar items, using a taxonomy defined outside this schema. For example, an email could be tagged with tags like 'internal', 'spam', 'external', 'rich-content', etc.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Tag" type="evt:TagSimpleType" minOccurs="1" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>A categorisation tag or label</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="MoveComplexType">
    <xs:annotation>
      <xs:documentation>Captures data relevant to move events, e.g. moving a file from one folder/device to another.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Source" type="evt:MultiObjectComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The source of the data being moved.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Destination" type="evt:MultiObjectComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The destination for the data being moved.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Outcome" type="evt:CopyMoveOutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the move was successful. If omitted it is assumed that the move was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="MultiObjectComplexType">
    <xs:annotation>
      <xs:documentation>Describes a collection of objects/entities that may be of different types.</xs:documentation>
    </xs:annotation>
    <xs:group ref="evt:MultiObjectGroup" minOccurs="1" maxOccurs="unbounded"/>
  </xs:complexType>
  <xs:complexType name="NetworkComplexType">
    <xs:annotation>
      <xs:documentation>A type to describe part of a computer network or some activity on a network.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseNetworkComplexType"/>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="NetworkEventActionComplexType">
    <xs:annotation>
      <xs:documentation>Describes an event involving some form of activity on a computer network.</xs:documentation>
    </xs:annotation>
    <xs:choice minOccurs="1" maxOccurs="1">
      <xs:element name="Bind" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of a server binding a network socket to a port and IP address.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Connect" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of a client system establishing a connection with a server.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Open" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of opening an unnamed socket that is bound to an address.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Close" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of closing an open socket or connection.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Send" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of sending data on a socket.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Receive" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of receiving data on a socket.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Listen" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of making a socket listen for connections.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Permit" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of network traffic being permitted by an Access Control List (ACL).</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Deny" type="evt:NetworkOutcomeComplexType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action of network traffic being denied by an Access Control List (ACL).</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit. Can also be used for appending data about the event after it has been received or processed, e.g. for recording details relating to the processing of the event such as the feed name.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:choice>
  </xs:complexType>
  <xs:complexType name="NetworkOutcomeComplexType">
    <xs:annotation>
      <xs:documentation>A type to describe some activity on a network along with the outcome of that activity.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseNetworkComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="NetworkLocationComplexType">
    <xs:annotation>
      <xs:documentation>Describes an end point within a network. This may be an application running on a device or a network appliance such as a switch.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Device" type="evt:DeviceComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A device at the source or destination involved in the network activity.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Application" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The application being used by the source or destination.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="TransportProtocol" type="evt:NetworkProtocolSimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The transport protocol being used by the source or destination.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="ICMPType" type="xs:integer" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The Internet Control Message Protocol type number. See https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="HTTPMethod" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The HTTP method, e.g. GET, POST, DELETE, PUT etc</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="ApplicationProtocol" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The application protocol being used by the source or destination.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Port" type="evt:PortSimpleType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The port being used by the source or destination.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="NotComplexType">
    <xs:annotation>
      <xs:documentation>The enclosed structure operators and terms are negated.</xs:documentation>
    </xs:annotation>
    <xs:group ref="evt:AdvancedQueryOperatorGroup" minOccurs="0" maxOccurs="unbounded"/>
  </xs:complexType>
  <xs:complexType name="ObjectComplexType">
    <xs:annotation>
      <xs:documentation>Describes a generic object or entity that cannot be described using any of the other more specific object types.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="OrComplexType">
    <xs:annotation>
      <xs:documentation>All of the enclosed items are to be treated as being OR together.</xs:documentation>
    </xs:annotation>
    <xs:group ref="evt:AdvancedQueryOperatorGroup" minOccurs="0" maxOccurs="unbounded"/>
  </xs:complexType>
  <xs:complexType name="OrganisationComplexType">
    <xs:annotation>
      <xs:documentation>Describes an organisation optionally qualified by its country</xs:documentation>
    </xs:annotation>
    <xs:sequence>
      <xs:element name="Country" type="evt:CountryTrigraphSimpleType" minOccurs="0">
        <xs:annotation>
          <xs:documentation>An ISO 3166 alpha-3 trigraph for the country the organisation belongs to. E.g. 'GBR'.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Organisation" type="xs:string">
        <xs:annotation>
          <xs:documentation>The code or name for the organisation. E.g. 'Group HQ', 'Telecoms Division', etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="OutcomeComplexType">
    <xs:annotation>
      <xs:documentation>Describes the outcome of an event whether it is successful and whether it was permitted.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseOutcomeComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="PrintComplexType">
    <xs:annotation>
      <xs:documentation>Describes an event relating to a printer, e.g. printing a document.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Action" type="evt:PrintActionSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The print action that was performed, e.g. CreateJob.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="PrintJob" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the print job that the event relates to.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Describes the print job that the event relates to.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Document" type="evt:DocumentComplexType" minOccurs="1" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>Describes the document being printed.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Pages" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The number of pages being printed.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Size" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The size of the print job in bytes.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Submitted" type="evt:DateTimeSimpleType" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The time that the print job was submitted.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="PrintSettings" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The printer settings that are to be used for the print job.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>The printer settings that are to be used for the print job.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="PaperSize" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The paper size, e.g. A4.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Orientation" type="evt:PrintSettingsOrientationSimpleType" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>The paper orientation, e.g. Portrait, Landscape.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Colour" type="xs:boolean" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>True if printing in colour. Most printing is performed in black and white so this defaults to false and can therefore be omitted if printing in black and white.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="DeviceFonts" type="xs:boolean" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>True if fonts are to be used on the printing device. Using device fonts reduces the size of the print job as no font information needs to be supplied to the printer. However, using device fonts will result in different output on different printers. Most print jobs will not use device fonts so this defaults to false and can therefore be omitted if device fonts are not being used.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Printer" type="evt:DeviceComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the printer to use for the print job.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ProcessComplexType">
    <xs:annotation>
      <xs:documentation>Describes various actions such as the startup/shutdown/install of operating systems, services, applications. It also describes the execution of operating system commands, shell scripts and batch processes.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Action" type="evt:ProcessActionSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The action that the process event is capturing, e.g. Startup, Shutdown.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Type" type="evt:ProcessTypeSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The type of process, e.g. Application, OS, Service.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Command" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the process.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Arguments" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The process command arguments/parameters.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="ProcessId" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The system identifier for the process.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="ThreadId" type="xs:positiveInteger" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The thread identifier for the process.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Rule" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The rule that was triggered when this process event happened.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Input" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Any objects used as input to the process.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Output" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Any objects output by the process</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="PurposeComplexType">
    <xs:annotation>
      <xs:documentation>Describes the purpose and justification for the event along with details of any authorisations that were required for the event to happen.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Classification" type="evt:ClassificationComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The classification of this task.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Subject" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A description of the task.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Stakeholders" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Names of stakeholders.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Justification" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Business case supporting task.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="ExpectedOutcome" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Expected outcome from task.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Authorisations" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The authorisations that were granted to allow this event action to take place.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Details of authorisations that were granted to allow this event action to take place.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Auth" minOccurs="1" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>An authorisation that was granted to allow this event action to take place.</xs:documentation>
              </xs:annotation>
              <xs:complexType>
                <xs:annotation>
                  <xs:documentation>Details of an authorisation that was granted to allow this event action to take place.</xs:documentation>
                </xs:annotation>
                <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="RefNo" type="xs:string" minOccurs="0" maxOccurs="1">
                    <xs:annotation>
                      <xs:documentation>The reference number, code or ID for the authorisation.</xs:documentation>
                    </xs:annotation>
                  </xs:element>
                  <xs:element name="Detail" type="xs:string" minOccurs="0" maxOccurs="1">
                    <xs:annotation>
                      <xs:documentation>A textual description of the authorisation or any additional detail.</xs:documentation>
                    </xs:annotation>
                  </xs:element>
                </xs:sequence>
              </xs:complexType>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="QueryComplexType">
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>An identifier to uniquely identify the query that was executed. This may be used to link the execution of a query (i.e. Search/Query/Id) with the results that are persisted and viewed at another time (i.e. View/SearchResults/Query/Id).</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the query that was executed. This may be used to link the execution of a query with the results that are persisted and viewed at another time.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A human-readable description of what the query is searching for.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Advanced" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A complex boolean tree or operators and terms that describes the query.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>A complex boolean tree or operators and terms that describes the query.</xs:documentation>
          </xs:annotation>
          <xs:group ref="evt:AdvancedQueryOperatorGroup" minOccurs="0" maxOccurs="unbounded"/>
        </xs:complexType>
      </xs:element>
      <xs:element name="Simple" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A simple representation of a query using includes and excludes terms. This is suitable for simple filtered lists, e.g. for a list of names excluding "John,Bob".</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>A simple representation of a query using includes and excludes terms. This is suitable for simple filtered lists, e.g. for a list of names excluding "John,Bob".</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Include" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>Values to include in the query results, typically delimited by a comma.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Exclude" type="xs:string" minOccurs="0" maxOccurs="1">
              <xs:annotation>
                <xs:documentation>Values to exclude in the query results, typically delimited by a comma.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Raw" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The raw query in the query language used by the application executing the query, e.g. SQL, xpath, etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ReceiveComplexType">
    <xs:annotation>
      <xs:documentation>Describes the action of receiving an object or entity, e.g. receiving a push notification.</xs:documentation>
    </xs:annotation>
    <xs:group ref="evt:SendReceiveGroup"/>
  </xs:complexType>
  <xs:complexType name="ResourceComplexType">
    <xs:annotation>
      <xs:documentation>Describes a resource within a website or web application, such as an HTML file, image file or script, along with the details of that resource such as size or response codes.  It can represent both successful and failed access to the resource object.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Title" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The title of the resource or of the object the resource presents.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="URL" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The URL of the resource the event relates to</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Referrer" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The URL of the resource that referred to the URL of this event</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="SessionId" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The session identifier or token used to identify a session or series of related message exchanges.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="HTTPMethod" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The HTTP method, e.g. GET, POST, DELETE, PUT etc</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="HTTPVersion" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The HTTP version, e.g. 1.1</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="UserAgent" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>This is a string provided by the initiating software agent used to identify itself, its application type, operating system, software vendor or software version. This string typically appears as a field in a request message with a field header name of 'User-Agent'.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="InboundSize" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The size in bytes received, including the request and HTTP headers.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="InboundContentSize" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The size in bytes of the incoming data, EXCLUDING HTTP headers.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="InboundHeader" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The HTTP request header.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="OutboundSize" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The size in bytes of the outgoing data, including HTTP headers.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="OutboundContentSize" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The size in bytes of the outgoing data, EXCLUDING HTTP headers.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="OutboundHeader" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The HTTP response header.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="RequestTime" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The number of microseconds the server took to handle the request.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="ConnectionStatus" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The connection status of the client connection.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="InitialResponseCode" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The status code of the original request.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="ResponseCode" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The final status code of the request, after any internal redirections may have taken place.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="MimeType" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The Internet Media Type identifying the file format of the resource provided (format of request or response body). This string typically appears in the 'Content-Type' field of a Request or Response Header.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Category" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The category of a web page or resource where a categorisation engine is used, e.g. News, Search Engine, Social Media, etc.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="SearchComplexType">
    <xs:annotation>
      <xs:documentation>Contains a criteria and describes the outcome of the event.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:group ref="evt:BaseObjectGroup" minOccurs="1" maxOccurs="1"/>
      <xs:group ref="evt:CriteriaExtensionGroup" minOccurs="1" maxOccurs="1"/>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="SearchResultsComplexType">
    <xs:annotation>
      <xs:documentation>Structure used to describe a set of search results from a query where the results are viewed or interacted with in a separate event to the execution of the query. E.g. for long-running queries where the results are stored for later viewing/processing. The Search schema action should be used to describe the event for the execution of the search. Query/Id or Query/Name can be used to associate the results event with the query event.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:group ref="evt:CriteriaExtensionGroup" minOccurs="1" maxOccurs="1"/>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="SendComplexType">
    <xs:annotation>
      <xs:documentation>Describes the action of sending something (e.g. a file, data, object, etc.) from a source location/application/system/user to a destination.</xs:documentation>
    </xs:annotation>
    <xs:group ref="evt:SendReceiveGroup"/>
  </xs:complexType>
  <xs:complexType name="ShortcutComplexType">
    <xs:annotation>
      <xs:documentation>Describes a shortcut to another file/object, such as a Windows Shortcut or linux symbolic link.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseFileComplexType"/>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="SoftwareComplexType">
    <xs:annotation>
      <xs:documentation>Used to describe a software asset.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>An identifier for the software asset.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the software product.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The version of the software product, e.g. v3.1.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Manufacturer" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The manufacturer of the software product, e.g. Borland</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="SystemComplexType">
    <xs:annotation>
      <xs:documentation>Describes the system that generated the event. This is not the same as the generator as the generator is merely the application or component that created the event, e.g. auditd. The system describes the higher level project/service or capability that uses the generator as a component, e.g. 'Payroll System'.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the system.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>An optional description of the system.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Classification" type="evt:ClassificationComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>An optional classification or protective marking of the overall system.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Environment" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The environment describes a specific instance of a system. A system may have multiple deployment for various purposes, e.g. a development, reference or operational deployment. An instance may also be site specific e.g. a deployment at a particular data center. The way an environment is described will differ depending on the system and the way it is deployed however a good example would be REF_DC1 to indicate that the environment is a reference deployment in data center 1.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Organisation" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the organisation that owns or has responsibility for the system.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="SecurityDomain" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>An optional element to define the domain that the system exists in.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The version of the system's software, e.g. 1.3.2</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Tags" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Optional tags that can be used for additional tagging or categorisation of the system. These tags allow for the grouping or filtering of similar systems.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:annotation>
            <xs:documentation>Optional tags that can be used for additional tagging or categorisation of the system. These tags allow for the grouping or filtering of similar systems.</xs:documentation>
          </xs:annotation>
          <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Tag" type="evt:TagSimpleType" minOccurs="1" maxOccurs="unbounded">
              <xs:annotation>
                <xs:documentation>A categorisation tag or label, e.g. 'critical-system', 'operational-data', 'non-operational-test-data', etc.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit. Can also be used for appending data about the event after it has been received or processed, e.g. for recording details relating to the processing of the event such as the feed name.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="TermComplexType">
    <xs:annotation>
      <xs:documentation>Describes a field to search and what to search for using name, condition and value, e.g. Title Contains 'Fox' or Title Equals 'The Quick Brown Fox'.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name of the search field.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Condition" type="evt:TermConditionSimpleType" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The search condition, e.g. Contains, !Contains, Exists etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Value" type="xs:string" minOccurs="1" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The value that the condition is operating on.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="UninstallComplexType">
    <xs:annotation>
      <xs:documentation>Describes the removal of either hardware or software.</xs:documentation>
    </xs:annotation>
    <xs:group maxOccurs="1" minOccurs="1" ref="evt:InstallationGroup"/>
  </xs:complexType>
  <xs:complexType name="UnknownComplexType">
    <xs:annotation>
      <xs:documentation>This type should be used were the type of the event cannot be described by any of the other event actions, or the event type is unknown.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="UpdateComplexType">
    <xs:annotation>
      <xs:documentation>Describes the update/modification/change to a file, object, entity, piece of data, etc. The update can be recorded by providing the Before and After state to describe the change. Alternatively, if the change is a small change to an object with many parts, it may be preferable to record the individual changes rather than the whole state. As a minimum the After state should be recorded to describe the object being changed with/without the detail of its state.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Before" type="evt:MultiObjectComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the state of one or more object properties before it was changed. Essentially a snapshot of the object before the change.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="After" type="evt:MultiObjectComplexType" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes the state of one or more object properties after it was changed. Essentially a snapshot of the object after the change.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element minOccurs="0" name="Changes">
        <xs:annotation>
          <xs:documentation>Describe one or more differences that have been applied to an object. When using this element, the object that the changes/differences are applied to should be described in the After element.</xs:documentation>
        </xs:annotation>
        <xs:complexType>
          <xs:sequence>
            <xs:element name="Add" type="evt:MultiObjectComplexType" minOccurs="0">
              <xs:annotation>
                <xs:documentation>Describes the addition of one of more parts of an object or entity. For example if the user is adding two files to a zip file containing 1000 files, this can be recorded as the addition of the two files. The details of the zip file can be recorded in the After element without the need to record the before and after state of all 1000/1002 files.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Replace" type="evt:MultiObjectComplexType" minOccurs="0">
              <xs:annotation>
                <xs:documentation>Describes the replacement of one of more parts of an object or entity. For example if the user is updating a single file in a zip file containing 1000 files, this can be recorded as the replacement of just that file. The details of the zip file can be record in the After element without the need to recorded the before and after state of all 1000 files.</xs:documentation>
              </xs:annotation>
            </xs:element>
            <xs:element name="Remove" type="evt:MultiObjectComplexType" minOccurs="0">
              <xs:annotation>
                <xs:documentation>Describes the removal of one of more parts of an object or entity. For example if the user is removing two files from a zip file containing 1000 files, this can be recorded as the addition of the two files. The details of the zip file can be recorded in the After element without the need to record the before and after state of all 1000/998 files.</xs:documentation>
              </xs:annotation>
            </xs:element>
          </xs:sequence>
        </xs:complexType>
      </xs:element>
      <xs:element name="Outcome" type="evt:OutcomeComplexType" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="UserComplexType">
    <xs:annotation>
      <xs:documentation>Describes a user entity that may represent a human or be a processing user account.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="Domain" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The security domain that the user exists within, e.g. an Active Directory or OpenLDAP domain.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="EmailAddress" type="evt:EmailAddressSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The email address of the user.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="UserDetails" type="evt:UserDetailsComplexType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The details of the person represented by the user account or identity.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="UserDetailsComplexType">
    <xs:annotation>
      <xs:documentation>Describes the person represented by a user account or identity.</xs:documentation>
    </xs:annotation>
    <xs:sequence minOccurs="1" maxOccurs="1">
      <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A unique identifier used across the business to identify this person.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="StaffNumber" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>A person's staff number.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Surname" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The person's surname.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Initials" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The person's initials.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Title" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The person's title.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="GivenName" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The person's given name. If a preferred name also exists then use KnownAs for this preferred name, otherwise use the same name for both elements.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="KnownAs" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The name that this person is known as.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="PersonType" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Is the person an employee or a contractor.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Group" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The business group.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Unit" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The business unit within the business group.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Position" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The position within the business unit.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Role" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The role that the person is in.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="GradeOfPost" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The grade required for the current post.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="EmploymentType" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Is the person full-time, part-time etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="EmploymentStatus" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The employment status of the person, e.g. Active, Retired, Maternity Leave, Sabbatical Leave, etc.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Nationality" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The person's nationality.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Location" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The building that the person usually works in.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="RoomNumber" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The room number or name that the person usually works in.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Phone" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The person's primary or internal phone number or extension.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="SecondaryPhone" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The person's secondary phone number or extension.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="SupervisorStaffNumber" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>The staff number of the person's supervisor or line manager.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="OccupancyEndDate" type="xs:date" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>When this person's current position is scheduled to end, e.g. the end date of a fixed term employment contract.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Organisation" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes a person's main employing organisation irrespective of who they are contracted or seconded to, or are performing an internship with.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="HostOrganisation" type="xs:string" minOccurs="0" maxOccurs="1">
        <xs:annotation>
          <xs:documentation>Describes which organisation is currently hosting a person if they are on secondment, internship or are contracted to work for.</xs:documentation>
        </xs:annotation>
      </xs:element>
      <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
        <xs:annotation>
          <xs:documentation>Any other user data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
        </xs:annotation>
      </xs:element>
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ViewComplexType">
    <xs:annotation>
      <xs:documentation>Describes events related to viewing data. Note that viewing data is subtly different from reading data. This event action is to be used when data is displayed to an end user and not for data read by an application.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectOutcomeComplexType"> </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="VirtualSessionComplexType">
    <xs:annotation>
      <xs:documentation>Describes the session used when viewing another user's session, e.g. screen sharing or remote assistance type activities.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="SessionState" type="evt:VirtualSessionSessionStateSimpleType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The state of the virtual session at the time of the event.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>
  <xs:complexType name="VOIPComplexType">
    <xs:annotation>
      <xs:documentation>Describes a Voice Over Internet Protocol call.</xs:documentation>
    </xs:annotation>
    <xs:complexContent>
      <xs:extension base="evt:BaseObjectComplexType">
        <xs:sequence minOccurs="1" maxOccurs="1">
          <xs:element name="PhoneNumber" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The phone number of the initiator of the call.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="From" type="evt:UserComplexType" minOccurs="0" maxOccurs="1">
            <xs:annotation>
              <xs:documentation>The user that initiated the call.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="To" type="evt:UserComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>The user that is the recipient of the call or a collection of users in the case of a conference type call.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="Data" type="evt:DataComplexType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
          </xs:element>
        </xs:sequence>
      </xs:extension>
    </xs:complexContent>
  </xs:complexType>

  <!-- Simple Types -->

  <xs:simpleType name="AlertPrioritySimpleType">
    <xs:annotation>
      <xs:documentation>The priorities that can be assigned to an alert, e.g. an error in a system or the alert from the detection of malware. They indicate how important it is to resolve or mitigate the alert.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="None"/>
      <xs:enumeration value="Low"/>
      <xs:enumeration value="Normal"/>
      <xs:enumeration value="High"/>
      <xs:enumeration value="Urgent"/>
      <xs:enumeration value="Immediate"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AlertSeveritySimpleType">
    <xs:annotation>
      <xs:documentation>The severities that can be assigned to an alert, e.g. an error in a system or the alert from the detection of malware. They indicate how far-reaching the symptoms of the cause of the alert are.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Info"/>
      <xs:enumeration value="Minor"/>
      <xs:enumeration value="Major"/>
      <xs:enumeration value="Critical"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AlertTypeSimpleType">
    <xs:annotation>
      <xs:documentation>The types of alert that can be fired, for example errors in an application log, malware or antivirus detection alerts.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Vulnerability"/>
      <xs:enumeration value="IDS"/>
      <xs:enumeration value="Malware"/>
      <xs:enumeration value="Network"/>
      <xs:enumeration value="Change"/>
      <xs:enumeration value="Error"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="ApprovalActionSimpleType">
    <xs:annotation>
      <xs:documentation>The stages in an approval workflow. E.g. when presenting a document for review before publishing.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Approve"/>
      <xs:enumeration value="Accept"/>
      <xs:enumeration value="Reject"/>
      <xs:enumeration value="RequestApproval"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AuthenticateActionSimpleType">
    <xs:annotation>
      <xs:documentation>The types of action in an authentication step.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Logon"/>
      <xs:enumeration value="Logoff"/>
      <xs:enumeration value="ChangePassword"/>
      <xs:enumeration value="ResetPassword"/>
      <xs:enumeration value="ScreenLock"/>
      <xs:enumeration value="ScreenUnlock"/>
      <xs:enumeration value="AccountLock"/>
      <xs:enumeration value="AccountUnlock"/>
      <xs:enumeration value="Reconnect"/>
      <xs:enumeration value="Disconnect"/>
      <xs:enumeration value="Connect"/>
      <xs:enumeration value="ElevatePrivilege"/>
      <xs:enumeration value="ReadToken"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AuthenticateLogonTypeSimpleType">
    <xs:annotation>
      <xs:documentation>The types of session that a logon event will relate to.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Interactive"/>
      <xs:enumeration value="Network"/>
      <xs:enumeration value="Batch"/>
      <xs:enumeration value="Service"/>
      <xs:enumeration value="Unlock"/>
      <xs:enumeration value="NetworkCleartext"/>
      <xs:enumeration value="NewCredentials"/>
      <xs:enumeration value="RemoteInteractive"/>
      <xs:enumeration value="CachedInteractive"/>
      <xs:enumeration value="CachedRemoteInteractive"/>
      <xs:enumeration value="CachedUnlock"/>
      <xs:enumeration value="Proxy"/>
      <xs:enumeration value="PhysicalAccess"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AuthenticateOutcomeReasonSimpleType">
    <xs:annotation>
      <xs:documentation>The types of outcome from an authentication event.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="IncorrectUsernameOrPassword"/>
      <xs:enumeration value="IncorrectUsername"/>
      <xs:enumeration value="IncorrectPassword"/>
      <xs:enumeration value="ExpiredCertificate"/>
      <xs:enumeration value="RevokedCertificate"/>
      <xs:enumeration value="IncorrectCA"/>
      <xs:enumeration value="ExpiredCA"/>
      <xs:enumeration value="AccountLocked"/>
      <xs:enumeration value="AccountNotValidForLoginType"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="AuthorisationSimpleType">
    <xs:annotation>
      <xs:documentation>The type of action in an authorisation event, e.g. the modification of authorisation permissions/groups or the request to be authorised.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Request">
        <xs:annotation>
          <xs:documentation>A request to be authorised to do a subsequent action.</xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="Modify">
        <xs:annotation>
          <xs:documentation>The action of modifying the permissions/rules/groups involved in an authorisation process.</xs:documentation>
        </xs:annotation>
      </xs:enumeration>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="ChangeActionSimpleType">
    <xs:annotation>
      <xs:documentation>The action performed by the file/directory monitor, e.g. starting to scan files for changes, or the detection of a file change.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="StartScan">
        <xs:annotation>
          <xs:documentation>The file/directory monitor is started.</xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="StopScan">
        <xs:annotation>
          <xs:documentation>The file/directory monitor is stopped.</xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="FileAdded">
        <xs:annotation>
          <xs:documentation>A new file had been added to the monitored directory.</xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="FileRemoved">
        <xs:annotation>
          <xs:documentation>A file has been removed from the monitored directory.</xs:documentation>
        </xs:annotation>
      </xs:enumeration>
      <xs:enumeration value="FileModified">
        <xs:annotation>
          <xs:documentation>A monitored file has been modified.</xs:documentation>
        </xs:annotation>
      </xs:enumeration>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="CopyMoveOutcomeReasonSimpleType">
    <xs:annotation>
      <xs:documentation>The types of reason for failure during copy or move operations.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="DeviceFull"/>
      <xs:enumeration value="IOError"/>
      <xs:enumeration value="InvalidPath"/>
      <xs:enumeration value="PermissionDenied"/>
      <xs:enumeration value="ReadOnly"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="CountryTrigraphSimpleType">
    <xs:annotation>
      <xs:documentation>An ISO 3166 alpha-3 country/nationality code. E.g 'GBR'</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="[A-Z]{3}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="DateTimeSimpleType">
    <xs:annotation>
      <xs:documentation>This type constrains the date time format further so that it is always represented as 'yyyy-MM-ddThh:mm:ss.sssZ'.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:dateTime">
      <xs:pattern value="[\d]{4}-[\d]{2}-[\d]{2}T[\d]{2}:[\d]{2}:[\d]{2}.[\d]{3}Z"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="DeviceMACAddressSimpleType">
    <xs:annotation>
      <xs:documentation>This type constrains the format of a MAC address.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="[0123456789ABCDEF]{2}(-[0123456789ABCDEF]{2}){5}"/>
      <xs:pattern value="[0123456789ABCDEF]{2}(:[0123456789ABCDEF]{2}){5}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="EmailAddressSimpleType">
    <xs:annotation>
      <xs:documentation>A type to define an email address.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string"/>
  </xs:simpleType>
  <xs:simpleType name="HardwareTypeSimpleType">
    <xs:annotation>
      <xs:documentation>The types of hardware that can be added or removed from a system.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="OpticalDrive"/>
      <xs:enumeration value="HardDisk"/>
      <xs:enumeration value="USBMassStorage"/>
      <xs:enumeration value="Printer"/>
      <xs:enumeration value="Modem"/>
      <xs:enumeration value="Keyboard"/>
      <xs:enumeration value="Mouse"/>
      <xs:enumeration value="Webcam"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="IPAddressSimpleType">
    <xs:annotation>
      <xs:documentation>A type to constrain an IP address.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:pattern value="(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      <xs:pattern value="::"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,1}(:[0-9a-f]{1,4}){1,6}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,5}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,4}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,3}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,5}(:[0-9a-f]{1,4}){1,2}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,6}(:[0-9a-f]{1,4}){1,1}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,7}:"/>
      <xs:pattern value=":(:[0-9a-f]{1,4}){1,7}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}"/>
      <xs:pattern value="::(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,1}(:[0-9a-f]{1,4}){1,4}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,3}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,2}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,1}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){1,5}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      <xs:pattern value=":(:[0-9a-f]{1,4}){1,5}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      <xs:pattern value="([0-9a-f]{1,4}:){6}(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="LatitudeSimpleType">
    <xs:annotation>
      <xs:documentation>Latitude from the equator in decimal degrees.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:decimal">
      <xs:minInclusive value="-90"/>
      <xs:maxInclusive value="90"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="LongitudeSimpleType">
    <xs:annotation>
      <xs:documentation>Longitude from the Greenwich Meridian in decimal degrees.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:decimal">
      <xs:minInclusive value="-180"/>
      <xs:maxInclusive value="180"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="MediaTypeSimpleType">
    <xs:annotation>
      <xs:documentation>The types of removable media.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="HardDisk"/>
      <xs:enumeration value="USBMassStorage"/>
      <xs:enumeration value="BluRay"/>
      <xs:enumeration value="DVD"/>
      <xs:enumeration value="CD"/>
      <xs:enumeration value="FloppyDisk"/>
      <xs:enumeration value="Tape"/>
      <xs:enumeration value="MemoryCard"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="NetworkProtocolSimpleType">
    <xs:annotation>
      <xs:documentation>The different types of network protocol.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="TCP"/>
      <xs:enumeration value="UDP"/>
      <xs:enumeration value="ICMP"/>
      <xs:enumeration value="IGMP"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="PermissionAttributeSimpleType">
    <xs:annotation>
      <xs:documentation>The types of permission that can be assigned to an entity such as a document.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Author"/>
      <xs:enumeration value="Create"/>
      <xs:enumeration value="Delete"/>
      <xs:enumeration value="Execute"/>
      <xs:enumeration value="Owner"/>
      <xs:enumeration value="Read"/>
      <xs:enumeration value="Use"/>
      <xs:enumeration value="Write"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="PortSimpleType">
    <xs:annotation>
      <xs:documentation>A type to constrain the format of a network port number.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:int">
      <xs:minInclusive value="0"/>
      <xs:maxInclusive value="65535"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="PrintActionSimpleType">
    <xs:annotation>
      <xs:documentation>The types of action relating to the use of a printer.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="CreateJob"/>
      <xs:enumeration value="CancelJob"/>
      <xs:enumeration value="PauseJob"/>
      <xs:enumeration value="ResumeJob"/>
      <xs:enumeration value="StartPrint"/>
      <xs:enumeration value="FinishPrint"/>
      <xs:enumeration value="CancelPrint"/>
      <xs:enumeration value="FailedPrint"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="PrintSettingsOrientationSimpleType">
    <xs:annotation>
      <xs:documentation>The orientation types of a document when it is printed.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Portrait"/>
      <xs:enumeration value="Landscape"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="ProcessActionSimpleType">
    <xs:annotation>
      <xs:documentation>The types of action in a process event, e.g. executing a shell script.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Startup"/>
      <xs:enumeration value="Shutdown"/>
      <xs:enumeration value="Execute"/>
      <xs:enumeration value="Terminate"/>
      <xs:enumeration value="ChangeDir"/>
      <xs:enumeration value="Call"/>
      <xs:enumeration value="Access"/>
      <xs:enumeration value="RequestObjectHandle"/>
      <xs:enumeration value="Register"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="ProcessTypeSimpleType">
    <xs:annotation>
      <xs:documentation>The types of a process event, e.g. a background process running within an application.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="OS"/>
      <xs:enumeration value="Service"/>
      <xs:enumeration value="Application"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="TagSimpleType">
    <xs:annotation>
      <xs:documentation>A type to allow constraining of metadata tag values in future.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string"/>
  </xs:simpleType>
  <xs:simpleType name="TermConditionSimpleType">
    <xs:annotation>
      <xs:documentation>The types of term used in query predicates.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Exists"/>
      <xs:enumeration value="NotExists"/>
      <xs:enumeration value="Contains"/>
      <xs:enumeration value="NotContains"/>
      <xs:enumeration value="Empty"/>
      <xs:enumeration value="NotEmpty"/>
      <xs:enumeration value="Equals"/>
      <xs:enumeration value="NotEquals"/>
      <xs:enumeration value="GreaterThan"/>
      <xs:enumeration value="GreaterThanEqualTo"/>
      <xs:enumeration value="LessThan"/>
      <xs:enumeration value="LessThanEqualTo"/>
      <xs:enumeration value="StartsWith"/>
      <xs:enumeration value="NotStartsWith"/>
      <xs:enumeration value="Regex"/>
      <xs:enumeration value="NotRegex"/>
      <xs:enumeration value="In"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="ThreatCategorySimpleType">
    <xs:annotation>
      <xs:documentation>The types of threat assigned to detected malware.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Virus"/>
      <xs:enumeration value="Worm"/>
      <xs:enumeration value="HackingTool"/>
      <xs:enumeration value="Spyware"/>
      <xs:enumeration value="TrojanHorse"/>
      <xs:enumeration value="Adware"/>
      <xs:enumeration value="Other"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="VersionSimpleType">
    <xs:annotation>
      <xs:documentation>Type for specifying the version numbers of XML documents that are supported by this version of the XMLSchema.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="4.1.0"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="VirtualSessionSessionStateSimpleType">
    <xs:annotation>
      <xs:documentation>Describes the state of a virtual session when viewing another user's session, e.g. screen sharing or remote assistance type activities.</xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:string">
      <xs:enumeration value="Parked"/>
      <xs:enumeration value="Unparked"/>
    </xs:restriction>
  </xs:simpleType>
</xs:schema>
<!-- vim: set tabstop=2 shiftwidth=2 expandtab : -->