ocsf
event_code and event_name
For log sources that have both an event_code and a corresponding event_name, and we want to keep both with the log in ocsf format, can we add event_name to the metadata object? We could notate that in the description that the default and required field is event_code and when there is both, then that is when to utilize the event_name as well...For example, to use event_name, event_code must be populated.
@send2stephy Great suggestion. I think this could be a good approach for reducing the ambiguity of event_code usage while closing the gap for instances where there are both a name and a code without introducing a breaking change. Seems worthy of a PR and straightforward enough. If you have cycles to submit a PR I would be happy to review, or if you don't have cycles I'd be happy to add one for this and include you as a reviewer to ensure it resolves the problem.
