ocsf-schema

ocsf-schema copied to clipboard

Is Categories an enum or an object?

2

[categories.json](https://github.com/ocsf/ocsf-schema/blob/main/categories.json) appears to be an enumerated list of items, but the items are called "attributes" as if they were properties of an object.: ``` { "caption": "Categories", "name": "category", "description":...

davaya

Create `agent` Object, add `agent` and `owner` to `endpoint`

1

#### Related Issue: #986 #### Description of changes: - Adds `owner` to `device`, `endpoint`, and `network_endpoint`. - Adds a new `agent` object that defines various sensors and agent. - Adds...

jonrau-at-queryai

#### Related Issue: #### Description of changes: The _query Discovery classes were in the 1.1.0 section, but they were not released with 1.1.0 at which time they were _info classes....

pagbabian-splunk

#### Related Issue: * https://github.com/ocsf/ocsf-schema/issues/960 * https://github.com/ocsf/ocsf-schema/issues/964 #### Description of changes: Metaschema changes. * Add class and object attribute observables. * Remove hard-coded list of categories from `metaschema/categories.schema.json`, leaving this...

rmouritzen-splunk

#### Related Issue: #989 #### Description of changes: - Added `List`, `Encrypt` and `Decrypt` activities to `datastore` event class.

Aniak5

#### Related Issue: #988 #### Description of changes: - Added `threat_intelligence` object. - Added `threat_intelligence` Profile based on `threat_intelligence` object. - Added `signatures` object, an array of `signature` objects. -...

jonrau-at-queryai

#### Related Issue: #985 #### Description of changes: - Created file profile - Added `file` profile to `api activity`, `web_resources_activity` and all `network` event classes.

Aniak5

Create File Profile

1

The logs within the network and API category event classes could have enriched file information. Create a file profile and apply to these categories.

Aniak5

Add additional activity ids such as `Enumerate`, `Encrypt` and `Decrypt` to the datastore event class.

Aniak5

**BLUF**: Add a new Profile for `threat_intelligence` that encompasses several existing, and some new, OCSF objects to provide conditional enrichment via cyber threat intelligence, open source intelligence, and/or analyst commentary....

jonrau-at-queryai