ocsf-schema
ocsf-schema copied to clipboard
Missing customer_uid attribute
The customer_uid attribute is missing from the base event. We need it to handle multi-tenant systems such as Splunk on cloud that handles events from multiple customers.
I believe customer_uid was a metadata attribute rather than a base event attribute.
Agreed, it's a better suited field for metadata. We had discussed it here as well.
Alternative is to create implementation specific profiles and add such fields to these profiles. Selecting a profile would overlay such fields for every class.