ocsf-schema
ocsf-schema copied to clipboard
Suggestions for update to the 1.2 _info family of Discovery classes
There is still confusion between the original Discovery classes that have the _info suffix and the new family of classes with that suffix. The former classes (Device Inventory Info, User Inventory Info) are clearly inventory requests, populating the Device and User respectively. However User Info is a targeted query of specific users. The other new _info classes are all similar and currently aren't confusing (e.g. File Info Folder Info etc.). However they have different semantics than the Inventory Info classes (i.e. Log Collect).
- I suggest renaming this family of classes using the
Queryterm rather than theInfoterm (i.e. `_query). - Add the
query_infoattribute as Optional to include details on the query if possible (although it may be self-evident with the class name specificity). - Change the
activity_idto beQueryrather than the current values which are results of the query (e.g.Exists). - Add a new
query_result_idenum and sibling for what are now listed inactivity_id(ExistsPartialDoes not existErrorUnsupported).