DICOM PS3.15 2025e - Security and System Management Profiles

A.5.3.10 Query

This message describes the event of a Query being issued or received. The message does not record the response to the query, but merely records the fact that a query was issued. For example, this would report queries using the DICOM SOP Classes:

  1. Modality Worklist

  2. UPS Pull

  3. UPS Watch

  4. Composite Instance Query

Note

  1. The response to a query may result in one or more DICOM Instances Transferred or DICOM Instances Accessed messages, depending on what events transpire after the query. If there were security-related failures, such as access violations, when processing a query, those failures should show up in other audit messages, such as a Security Alert message.

  2. Non-DICOM queries may also be captured by this message. The Participant Object ID Type Code, the Participant Object ID, and the Query fields may have values related to such non-DICOM queries.

Table A.5.3.10-1. Audit Message for Query

Real-World Entities

Field Name

Opt.

Value Constraints

Event: EventIdentification

EventID

M

EV (110112, DCM, "Query")

EventActionCode

M

Shall be:

E

Execute

EventDateTime

M

Not specialized.

EventOutcomeIndicator

M

Not specialized.

EventTypeCode

U

Not specialized.

Active Participant: ActiveParticipant

Process issuing the query (1)

UserID

M

Not specialized.

AlternativeUserID

U

Not specialized.

UserName

U

Not specialized.

UserIsRequestor

M

Not specialized.

RoleIDCode

M

EV (110153, DCM, "Source Role ID")

NetworkAccessPointTypeCode

U

Not specialized.

NetworkAccessPointID

U

Not specialized.

Active Participant: ActiveParticipant

The process that will respond to the query (1)

UserID

M

Not specialized.

AlternativeUserID

U

Not specialized.

UserName

U

Not specialized.

UserIsRequestor

M

Not specialized.

RoleIDCode

M

EV (110152, DCM, "Destination Role ID")

NetworkAccessPointTypeCode

U

Not specialized.

NetworkAccessPointID

U

Not specialized.

Active Participant: ActiveParticipant

Other participants that are known, especially third parties that requested the query (0..N)

UserID

M

Not specialized.

AlternativeUserID

U

Not specialized.

UserName

U

Not specialized.

UserIsRequestor

M

Not specialized.

RoleIDCode

U

Not specialized.

NetworkAccessPointTypeCode

U

Not specialized.

NetworkAccessPointID

U

Not specialized.

Participant Object: ParticipantObjectIdentification

SOP Class queried and the query (1)

ParticipantObjectTypeCode

M

Shall be:

2

System Object

ParticipantObjectTypeCodeRole

M

Shall be:

3

Report

ParticipantObjectDataLifeCycle

U

Not specialized.

ParticipantObjectIDTypeCode

M

DT (110181, DCM, "SOP Class UID")

ParticipantObjectSensitivity

U

Not specialized.

ParticipantObjectID

M

If the ParticipantObjectIDTypeCode is (110181, DCM, "SOP Class UID"), then this field shall hold the UID of the SOP Class being queried.

ParticipantObjectQuery

M

If the ParticipantObjectIDTypeCode is (110181, DCM, "SOP Class UID"), then this field shall hold the Data Set of the DICOM query, xs:base64Binary encoded. Otherwise, it shall be the query in the format of the protocol used.

ParticipantObjectDetail

MC

Required if the ParticipantObjectIDTypeCode is (110181, DCM, "SOP Class UID")

A ParticipantObjectDetail element with the XML attribute "TransferSyntax" shall be present. The value of the Transfer Syntax attribute shall be the UID of the transfer syntax of the query. The element contents shall be xs:base64Binary encoding. The Transfer Syntax shall be a DICOM Transfer Syntax.

ParticipantObjectDescription

U

Not specialized.

SOPClass

U

See Section A.5.2.

Accession

U

Not specialized.

NumberOfInstances

U

Not specialized.

Instance

U

Not specialized.

Encrypted

U

Not specialized.

Anonymized

U

Not specialized.


DICOM PS3.15 2025e - Security and System Management Profiles