ocsf-schema icon indicating copy to clipboard operation
ocsf-schema copied to clipboard

Metaschema: support event class and object attribute observables

Open rmouritzen-splunk opened this issue 11 months ago • 0 comments

Related Issue:

  • https://github.com/ocsf/ocsf-schema/issues/960
  • https://github.com/ocsf/ocsf-schema/issues/964

Description of changes:

Metaschema changes.

  • Add class and object attribute observables.
  • Remove hard-coded list of categories from metaschema/categories.schema.json, leaving this to the ocsf-validator. This change makes testing with alternate schemas that may add extra categories easier, as well as making it possible to validate private extensions that contain new categories.
  • Detect unexpected top-level properties in object and event class definitions. This was added at this point to detect invalid observable definitions: invalid top-level observable property in event classes, and invalid top-level observables property in objects.

rmouritzen-splunk avatar Mar 21 '24 19:03 rmouritzen-splunk