event-logging-schema
event-logging-schema copied to clipboard
Add Veracity field or fields
Ideally, all events are created on a locked down server and only ever transferred securely. But in some organisations / situations it might be appropriate or necessary to:
- Transfer via Syslog UDP,
- Transfer manually,
- Create on a client-side process under user control.
- Etc.
Therefore, it would be useful to record the level of veracity of the event, so it can be taken into account later, as necessary (e.g. treated with a degree of suspicion!)
Don't know the best way to do this, as ideally some information about the provenance of the event would be recorded. But it is probably sufficient to roll up into a single value (High/Medium/Low), at least for a first version.
I'd suggest the definition of a VeracityComplexType that can hold say
- Veracity - a scale as mentioned (High/Medium/Low)
- Contributors - a list of contributing factors that inform the Veracity. Each contributor can hold, say
- Citation - some mechanism that is measured in terms of confidence (i.e. Source, Transport, Timeliness, etc.)
- Confidence - a scale for the citation (again perhaps High/Medium/Low)
- ??? - some other features that contribute
- Description - some simple description supporting the veracity claim.
and then make use of this type in the EventSourceType
@burnalting that sounds good to me.