ocsf-schema
ocsf-schema copied to clipboard
ocsf
OCSF Schema
As far as I checked, none of the JSON files currently refers to a JSON schema. I would like to suggest to define JSON schemas to make sure that changes...
For the new `datetime_t` data type, Proposal 11 had a profile that would overlay a companion attribute everywhere there is a `timestamp_t` data type. Rather than use an actual profile,...
The customer_uid attribute is missing from the base event. We need it to handle multi-tenant systems such as Splunk on cloud that handles events from multiple customers.
Updated container activity event class. Added UID and some name changes. Tested the json files on local server, which resulted in 0 errors. Screenshot of UI attached. Signed-off-by: Ashish Verma...
In the container schema, the following item is defined: ```json "sha2": { "description": "Commit hash of image created for docker or the SHA256 hash of the container. For example: a3bf90e006b2.",...
1. Define structure of the `origin` object 2. Clean up & refine originally present attributes under the origin object 3. Move `origin` under `metadata` 4. Revert related changes made in...
### Discussed in https://github.com/ocsf/ocsf-schema/discussions/84 Originally posted by **rroupski** July 19, 2022 Attributes that are either generated or derived by the collection, post-collection processing, or storage systems other than the mapping...
Adds new producer object to metadata object. This is to describe an event origin such as Vendor and Product. Signed-off-by: Julian Crowley [email protected]
Clarifies the definition and usage for the Product object. Signed-off-by: Julian Crowley [[email protected]](mailto:[email protected])
There are many time attribute, see the picture. The names are not very consistent. Some use nouns, others use past tense verbs. We should pick one form only.