When coding veris, only select 'Unknown' when it is known the parent existed, but nothing else is known. If it is not known the parent existed, select nothing under the parent.
For example, if you are aware a hacking action occurred, but nothing else, choose 'action.hacking.variety.Unknown. If you are unaware of if a hacking action occurred, select nothing under action.hacking.
Another common example is in event_chain. Choosing "event_chain.money laundering.variety.Unknown" means Money Laundering occurred. Choosing no variety of money laundering means nothing is known about whether money laundering occurred or not.
When coding veris, only select 'Unknown' when it is known the parent existed, but nothing else is known. If it is not known the parent existed, select nothing under the parent.
For example, if you are aware a hacking action occurred, but nothing else, choose 'action.hacking.variety.Unknown. If you are unaware of if a hacking action occurred, select nothing under action.hacking.
Another common example is in event_chain. Choosing "event_chain.money laundering.variety.Unknown" means Money Laundering occurred. Choosing no variety of money laundering means nothing is known about whether money laundering occurred or not.