Location¶

The Location asset type in the OWASP Open Asset Model (OAM) represents a physical, postal, or geo-administrative address where an entity, asset, or infrastructure component is situated. Modeling locations is essential for physical security, compliance, and geo-contextual threat intelligence.

Definition: A Location asset encapsulates structured geographic and civic data elements such as street name, building number, city, province, country, and more. It is designed to express physical placement or registration information for various assets in the OAM.
Purpose: By defining Location as a core asset, the model enables linkage between digital infrastructure and their physical contexts. This supports use cases like data residency enforcement, regional exposure analysis, and logistics around physical components of an attack surface.
Design Choice: Each attribute within the Location asset is modeled with optionality in mind, allowing broad applicability — from a complete civic address to partial location data such as city-only or PO Box information. The inclusion of a GLN (Global Location Number) field aligns with standardized supply chain and logistics frameworks.

In summary, the Location asset type serves as a structured and flexible mechanism for tying assets to their real-world geographic presence — aiding in operational awareness, compliance mapping, and geospatial intelligence.

Location Attributes¶

Attributes	Type	Description
`address`	string	Full unstructured address (fallback or human-readable)
`building`	string	Building name or identifier
`building_number`	string	Street number of the building
`street_name`	string	Name of the street
`unit`	string	Apartment, suite, or unit number
`po_box`	string	Post office box number
`city`	string	City or municipality name
`locality`	string	District, borough, or neighborhood name
`province`	string	State, province, or administrative div
`country`	string	Country name (ISO recommended)
`postal_code`	string	ZIP or postal code
`gln`	int	Global Location Number (GS1 standard)

Location Properties¶

Property Type	Property Name	Description
`SimpleProperty`	`last_monitored`	Tracks when a data source was last queried regarding this Location
`SourceProperty`	Source Plugin Name	Indicates that the specified data source discovered this Location

Location Outgoing Relations¶

graph TD
loc["Location (e.g. Frankfurt)"]
ident["Identifier (e.g. AWS Data Center)"]
rel@{ shape: braces, label: "id" }
loc --o rel
rel --> ident

Relation Type	Relation Label	Target Assets	Description
`SimpleRelation`	`id`	`Identifier`	Links the `Location` alternative IDs, such as facility names