ocsf-schema icon indicating copy to clipboard operation
ocsf-schema copied to clipboard

Base Network class should not include activity_id

Open pagbabian-splunk opened this issue 1 year ago • 1 comments

The network.json file is the category base for the Network Activity. It defines the activity_id attribute that shouldn't assume all extended classes share the same values. (There is a behavior of the server that also kicks in - if the extending class overrides activity_id and has fewer items, those items are overridden but the additional items are brought in from the base. This is not a good way to develop, and can have side effects).

Although not a hard fast rule, activity_ids should be paired with class_uid and reflected directly in the class via type_uid.

I suggest we remove the activity_id from network.json and each extending class should specifically define the activity_id.

This isn't always a problem, e.g. for Discovery all of the extending classes purposely share the same two activity_ids. Similarly for the Finding category. System IAM and Application already delegate to the extending classes.

pagbabian-splunk avatar Jan 04 '24 20:01 pagbabian-splunk