Rajas

Agreed, it's a better suited field for metadata. We had discussed it [here](https://github.com/ocsf/ocsf-schema/pull/135) as well. Alternative is to create implementation specific profiles and add such fields to these profiles. Selecting...

Based on the Aug 4th call, the OCSF reserved attribute list is decided to be - 1. `_time` 2. `_uid` 3. `_raw_data`

PR to update descriptions - https://github.com/ocsf/ocsf-schema/pull/272

The current `severity` field addresses your concern.  --- I would qualify this line by stating that how we handle such pairs (severity/severity_id,...

> [Note: the public server doesn't have the status_id enums.] Perhaps your filters for `recommended` fields are unchecked. I can see the enums for `status_id` field. >Note that the dictionary...

I like the idea. We can expand this mechanism in general to "sibling" attributes across OCSF. The concept of sibling exists in the framework (currently used in string/int enum attributes...

@zschmerber @rickmode Continuing the discussion from the slack thread, this looks good. 1 thing to note though, the nested ja4_sections need not be called ja4_sections. It adds the redundancy -...

I think ja4 as a name is fine, considering the specific nature of it. On the point raised by @mikeradka - my concern is if do not have real world...

Sorry, I have been away for a couple of weeks. I don't think we would benefit from separating out different types of Cloud API events into different event classes for...

Looks good, along with the .md file, we'll need to update the corresponding pdf file as well - Understanding OCSF.pdf