ocsf-schema icon indicating copy to clipboard operation
ocsf-schema copied to clipboard

Boolean Attribute Descriptions in Dictionary

Open mikeradka opened this issue 1 year ago • 0 comments

While applying consistency to Boolean attribute naming using is_ via #841, we found some areas for improvement of the general dictionary descriptions for most of the boolean attributes.

A Boolean attribute can indicate different specific things depending on the context of the event class in which it is used.

For example, is_superseded can refer to a kb article, but it can also refer to a patch. What is superseded? It depends on the context of the event.

Same goes for is_secure. The boolean name does not answer what is secure in the event's context, which should have a specific usage.

We have a few options at top-of-mind:

For booleans that are not self-explanatory (ie do not answer the what):

  1. We could make their general dictionary descriptions something like:
is_http_only: A flag which indicates http only. See specific usage.
is_superseded: A flag which indicates superseded. See specific usage.
is_secure: A flag which indicates secure. See specific usage.
  1. We could adopt an even more general dictionary description for boolean attributes that are not self explanatory (ie do not answer the what):
A generic flag pertaining to classes and objects. See specific usage.

Keep in mind that a part of this will entail ensuring that all references with specific usages will need to be updated accordingly.

mikeradka avatar Nov 08 '23 16:11 mikeradka