ocsf-schema
ocsf-schema copied to clipboard
TCP Flags should be directional
I was looking at the data dictionary on https://schema.ocsf.io/1.1.0/dictionary?extensions= and noticed that the tcp_flags are set on the Network Connection Information object with no directionality specified.
My understanding is TCP flags are directional and should exist on the Network Traffic object since it is directional in nature.
See https://www.site24x7.com/learn/linux/tcp-flags.html for an example that TCP flags are set in each packet. In systems that log network traffic, TCP flags that are received by the system and sent by the system will be different.