ocsf-schema icon indicating copy to clipboard operation
ocsf-schema copied to clipboard

Suggestions for update to the 1.2 _info family of Discovery classes

Open pagbabian-splunk opened this issue 1 year ago • 0 comments

There is still confusion between the original Discovery classes that have the _info suffix and the new family of classes with that suffix. The former classes (Device Inventory Info, User Inventory Info) are clearly inventory requests, populating the Device and User respectively. However User Info is a targeted query of specific users. The other new _info classes are all similar and currently aren't confusing (e.g. File Info Folder Info etc.). However they have different semantics than the Inventory Info classes (i.e. Log Collect).

  1. I suggest renaming this family of classes using the Query term rather than the Info term (i.e. `_query).
  2. Add the query_info attribute as Optional to include details on the query if possible (although it may be self-evident with the class name specificity).
  3. Change the activity_id to be Query rather than the current values which are results of the query (e.g. Exists).
  4. Add a new query_result_id enum and sibling for what are now listed in activity_id (Exists Partial Does not exist Error Unsupported).

pagbabian-splunk avatar Feb 07 '24 18:02 pagbabian-splunk