ocsf-schema
ocsf-schema copied to clipboard
Boolean Attribute Descriptions in Dictionary
While applying consistency to Boolean attribute naming using is_
via #841, we found some areas for improvement of the general dictionary descriptions for most of the boolean attributes.
A Boolean attribute can indicate different specific things depending on the context of the event class in which it is used.
For example, is_superseded
can refer to a kb article
, but it can also refer to a patch
. What is superseded? It depends on the context of the event.
Same goes for is_secure
. The boolean name does not answer what is secure in the event's context, which should have a specific usage.
We have a few options at top-of-mind:
For booleans that are not self-explanatory (ie do not answer the what):
- We could make their general dictionary descriptions something like:
is_http_only: A flag which indicates http only. See specific usage.
is_superseded: A flag which indicates superseded. See specific usage.
is_secure: A flag which indicates secure. See specific usage.
- We could adopt an even more general dictionary description for boolean attributes that are not self explanatory (ie do not answer the what):
A generic flag pertaining to classes and objects. See specific usage.
Keep in mind that a part of this will entail ensuring that all references with specific usages will need to be updated accordingly.