ocsf-schema
ocsf-schema copied to clipboard
Suggestions for update to the 1.2 _info family of Discovery classes
There is still confusion between the original Discovery classes that have the _info
suffix and the new family of classes with that suffix. The former classes (Device Inventory Info, User Inventory Info) are clearly inventory requests, populating the Device
and User
respectively. However User Info
is a targeted query of specific users. The other new _info
classes are all similar and currently aren't confusing (e.g. File Info
Folder Info
etc.). However they have different semantics than the Inventory Info classes (i.e. Log
Collect
).
- I suggest renaming this family of classes using the
Query
term rather than theInfo
term (i.e. `_query). - Add the
query_info
attribute as Optional to include details on the query if possible (although it may be self-evident with the class name specificity). - Change the
activity_id
to beQuery
rather than the current values which are results of the query (e.g.Exists
). - Add a new
query_result_id
enum and sibling for what are now listed inactivity_id
(Exists
Partial
Does not exist
Error
Unsupported
).