trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-31 07:44:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(ocsf): emit schema-conformant OCSF 1.8 events (#4288)

Browse Source 
Native events failed the official OCSF 1.8.0 validator: HTTP Activity
emitted is_src_dst_assignment_known, sandbox Process Activity events had
no actor, connection_info lacked direction_id, and SSH Activity events
named no endpoint. Schema tests missed these because they checked only
top-level, non-profile attributes.

Add a connection direction enum, require an actor on Process Activity
and an endpoint on SSH Activity at compile time, and name the
supervisor's SSH server with svc_name and its socket path.

Validate against OCSF 1.8.0 only. validate_required_fields and
validate_known_fields share one recursive walker that rejects undefined
attributes at every level and, for events, attributes from undeclared
profiles; objects are validated as objects. Records labelled with
another version fail. Vendor tactic and technique so ATT&CK-mapped
findings validate, drop the unused v1.7.0 schemas, and make the
embedded-schema drift test tolerate CRLF checkouts.

Keep it fixed with a per-builder conformance test and a Podman e2e test
that runs an L7 policy against a local server and validates the
supervisor's real Network, HTTP and SSH Activity JSONL. Top-level
container stays unchanged; #4915 tracks it. The schema
downgrade is unchanged.

Closes #4283

Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
This commit is contained in:
Adel Zaalouk
2026-10-28 20:50:57 +00:00
committed by GitHub
parent 6188420e9d
commit def7da876c
58 changed files with 1630 additions and 14729 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/openshell-ocsf/schemas/ocsf/README.md
Generated
+61 -11
View File
@@ -5,7 +5,7 @@ for offline test validation.
## Version
- **OCSF v1.8.0** — fetched from `https://schema.ocsf.io/api/1.8.0/`
- **OCSF v1.8.0**, fetched from `https://schema.ocsf.io/api/1.8.0/`
## Contents
@@ -22,41 +22,91 @@ for offline test validation.
- `authentication` [3002]
- `base_event` [0]
### Objects (23)
### Objects (26)
- `metadata`, `network_endpoint`, `network_proxy`, `process`, `actor`
- `device`, `container`, `product`, `firewall_rule`, `finding_info`
- `evidences`, `http_request`, `http_response`, `url`, `attack`
- `remediation`, `connection_info`, `ai_model`, `api`, `user`, `service`, `os`,
`resource_details`
- `remediation`, `connection_info`, `network_connection_info`, `ai_model`,
`api`, `user`, `service`, `os`, `resource_details`, `tactic`, `technique`
### Profiles (1)
- `ai_operation`
The validator loads an object schema for every object attribute an event
carries, so a missing file fails the test with `Missing vendored schema: ...`;
vendor that object.
With the `test-support` feature, the schemas are compiled into the binary
(`src/validation/embedded.rs`), so archived test binaries run on other machines
need no files from this directory.
## Updating
To update to a new OCSF version:
```bash
VERSION=1.8.0
DIR="v${VERSION}"
mkdir -p "${DIR}/classes" "${DIR}/objects"
for class in network_activity http_activity ssh_activity process_activity \
detection_finding application_lifecycle device_config_state_change \
api_activity authentication base_event; do
curl -s "https://schema.ocsf.io/api/${VERSION}/classes/${class}" \
| python3 -m json.tool > "classes/${class}.json"
curl -sf "https://schema.ocsf.io/api/${VERSION}/classes/${class}" \
| python3 -m json.tool > "${DIR}/classes/${class}.json"
done
for object in metadata network_endpoint network_proxy process actor device \
container product firewall_rule finding_info evidences \
http_request http_response url attack remediation connection_info \
ai_model api user service os; do
curl -s "https://schema.ocsf.io/api/${VERSION}/objects/${object}" \
| python3 -m json.tool > "objects/${object}.json"
network_connection_info ai_model api user service os resource_details tactic technique; do
curl -sf "https://schema.ocsf.io/api/${VERSION}/objects/${object}" \
| python3 -m json.tool > "${DIR}/objects/${object}.json"
done
echo "${VERSION}" > VERSION
echo "${VERSION}" > "${DIR}/VERSION"
```
Then update `OCSF_VERSION` in `crates/openshell-ocsf/src/lib.rs` to match.
After adding or removing any schema file, regenerate the embedded table:
```bash
UPDATE_OCSF_EMBEDDED_SCHEMAS=1 cargo test -p openshell-ocsf embedded_schemas
```
Then update `OCSF_VERSION` in `crates/openshell-ocsf/src/lib.rs` to match, run
`cargo test -p openshell-ocsf` (`every_builder_emits_schema_conformant_events`
reports attributes that are newly required, renamed, or undefined), and update
the version strings in `docs/observability/ocsf-json-export.mdx`.
## Validating against the official OCSF server
The vendored-schema validator checks presence, nesting, undefined attributes,
and profiles. It does not check value types or enum ranges. To check those,
run the official [OCSF server](https://github.com/ocsf/ocsf-server) locally:
```bash
git clone --depth 1 https://github.com/ocsf/ocsf-server.git
podman build -t ocsf-server ocsf-server
# The compiler requires Python 3.14 or later.
uv venv --python 3.14 .venv && uv pip install --python .venv/bin/python ocsf-schema-compiler
mkdir -p compiled
git clone --depth 1 --branch v1.8.0 https://github.com/ocsf/ocsf-schema.git ocsf-schema-v1.8.0
.venv/bin/ocsf-schema-compiler ocsf-schema-v1.8.0 -b > compiled/ocsf-schema-v1.8.0-browser.json
podman run -d --name ocsf-1.8.0 -v "$PWD/compiled:/app/schemas:ro" \
-e SCHEMA_FILE=/app/schemas/ocsf-schema-v1.8.0-browser.json \
-p 127.0.0.1:18150:8080 ocsf-server
```
Then `POST` each JSONL record to `http://127.0.0.1:18150/api/v2/validate`. A
record is valid when the response has `"error_count": 0`; the response lists
each problem under `errors`. Use the v2 endpoint: the older `/api/validate`
does not report constraint failures such as `at_least_one`, so a record missing
both endpoints can look valid.
To check against the hosted server instead, use
`https://schema.ocsf.io/api/1.8.0/v2/validate`. Keep the version in the path;
the unversioned `/api/v2/validate` validates against the latest OCSF version.
crates/openshell-ocsf/schemas/ocsf/v1.7.0/VERSION
Generated
-1
View File
@@ -1 +0,0 @@
1.7.0
crates/openshell-ocsf/schemas/ocsf/v1.7.0/classes/application_lifecycle.json
Generated
-1047
View File
File diff suppressed because it is too large Load Diff
crates/openshell-ocsf/schemas/ocsf/v1.7.0/classes/base_event.json
Generated
-964
View File
@@ -1,964 +0,0 @@
{
"attributes": [
{
"severity": {
"type": "string_t",
"description": "The event/finding severity, normalized to the caption of the <code>severity_id</code> value. In the case of 'Other', it is defined by the source.",
"group": "classification",
"requirement": "optional",
"caption": "Severity",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "severity_id"
}
},
{
"risk_level": {
"profile": "security_control",
"type": "string_t",
"description": "The risk level, normalized to the caption of the risk_level_id value.",
"group": "context",
"requirement": "optional",
"caption": "Risk Level",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "risk_level_id"
}
},
{
"status_code": {
"type": "string_t",
"description": "The event status code, as reported by the event source.<br /><br />For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.",
"group": "primary",
"requirement": "recommended",
"caption": "Status Code",
"type_name": "String",
"_source": "base_event"
}
},
{
"start_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The start time of a time period, or the time of the least recent event included in the aggregate event.",
"group": "occurrence",
"requirement": "optional",
"caption": "Start Time",
"type_name": "Datetime",
"_source": "base_event"
}
},
{
"osint": {
"profile": "osint",
"type": "object_t",
"description": "The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.",
"group": "primary",
"is_array": true,
"requirement": "required",
"caption": "OSINT",
"object_name": "OSINT",
"object_type": "osint",
"_source": "base_event"
}
},
{
"confidence": {
"profile": "security_control",
"type": "string_t",
"description": "The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.",
"group": "context",
"requirement": "optional",
"caption": "Confidence",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "confidence_id"
}
},
{
"policy": {
"profile": "security_control",
"type": "object_t",
"description": "The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy.",
"group": "primary",
"requirement": "optional",
"caption": "Policy",
"object_name": "Policy",
"object_type": "policy",
"_source": "base_event"
}
},
{
"action_id": {
"profile": "security_control",
"type": "integer_t",
"enum": {
"3": {
"description": "The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The <code>disposition_id</code> attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc.",
"caption": "Observed"
},
"0": {
"description": "The action was unknown. The <code>disposition_id</code> attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'.",
"caption": "Unknown"
},
"1": {
"description": "The activity was allowed. The <code>disposition_id</code> attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.",
"caption": "Allowed"
},
"2": {
"description": "The attempted activity was denied. The <code>disposition_id</code> attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.",
"caption": "Denied"
},
"99": {
"description": "The action is not mapped. See the <code>action</code> attribute which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "The activity was modified, adjusted, or corrected. The <code>disposition_id</code> attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.",
"caption": "Modified"
}
},
"description": "The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to <code>disposition_id</code> for the outcome of the action.",
"group": "primary",
"requirement": "recommended",
"caption": "Action ID",
"type_name": "Integer",
"sibling": "action",
"_source": "base_event"
}
},
{
"authorizations": {
"profile": "security_control",
"type": "object_t",
"description": "Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.",
"group": "primary",
"is_array": true,
"requirement": "optional",
"caption": "Authorization Information",
"object_name": "Authorization Result",
"object_type": "authorization",
"_source": "base_event"
}
},
{
"firewall_rule": {
"profile": "security_control",
"type": "object_t",
"description": "The firewall rule that pertains to the control that triggered the event, if applicable.",
"group": "primary",
"requirement": "optional",
"caption": "Firewall Rule",
"object_name": "Firewall Rule",
"object_type": "firewall_rule",
"_source": "base_event"
}
},
{
"raw_data_hash": {
"type": "object_t",
"description": "The hash, which describes the content of the raw_data field.",
"group": "context",
"requirement": "optional",
"caption": "Raw Data Hash",
"object_name": "Fingerprint",
"object_type": "fingerprint",
"_source": "base_event"
}
},
{
"time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The normalized event occurrence time or the finding creation time.",
"group": "occurrence",
"requirement": "optional",
"caption": "Event Time",
"type_name": "Datetime",
"_source": "base_event"
}
},
{
"risk_level_id": {
"profile": "security_control",
"type": "integer_t",
"enum": {
"3": {
"caption": "High"
},
"0": {
"caption": "Info"
},
"1": {
"caption": "Low"
},
"2": {
"caption": "Medium"
},
"99": {
"description": "The risk level is not mapped. See the <code>risk_level</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"caption": "Critical"
}
},
"description": "The normalized risk level id.",
"group": "context",
"requirement": "optional",
"caption": "Risk Level ID",
"type_name": "Integer",
"sibling": "risk_level",
"_source": "base_event",
"suppress_checks": [
"enum_convention"
]
}
},
{
"risk_details": {
"profile": "security_control",
"type": "string_t",
"description": "Describes the risk associated with the finding.",
"group": "context",
"requirement": "optional",
"caption": "Risk Details",
"type_name": "String",
"_source": "base_event"
}
},
{
"disposition_id": {
"profile": "security_control",
"type": "integer_t",
"enum": {
"3": {
"description": "A suspicious file or other content was moved to a benign location.",
"caption": "Quarantined"
},
"6": {
"description": "The request was detected as a threat and resulted in the connection being dropped.",
"caption": "Dropped"
},
"0": {
"description": "The disposition is unknown.",
"caption": "Unknown"
},
"1": {
"description": "Granted access or allowed the action to the protected resource.",
"caption": "Allowed"
},
"2": {
"description": "Denied access or blocked the action to the protected resource.",
"caption": "Blocked"
},
"99": {
"description": "The disposition is not mapped. See the <code>disposition</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "A session was isolated on the network or within a browser.",
"caption": "Isolated"
},
"5": {
"description": "A file or other content was deleted.",
"caption": "Deleted"
},
"7": {
"description": "A custom action was executed such as running of a command script. Use the <code>message</code> attribute of the base class for details.",
"caption": "Custom Action"
},
"8": {
"description": "A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from <code>1</code> 'Allowed'.",
"caption": "Approved"
},
"9": {
"description": "A quarantined file or other content was restored to its original location.",
"caption": "Restored"
},
"10": {
"description": "A suspicious or risky entity was deemed to no longer be suspicious (re-scored).",
"caption": "Exonerated"
},
"11": {
"description": "A corrupt file or configuration was corrected.",
"caption": "Corrected"
},
"12": {
"description": "A corrupt file or configuration was partially corrected.",
"caption": "Partially Corrected"
},
"14": {
"description": "An operation was delayed, for example if a restart was required to finish the operation.",
"caption": "Delayed"
},
"15": {
"description": "Suspicious activity or a policy violation was detected without further action.",
"caption": "Detected"
},
"16": {
"description": "The outcome of an operation had no action taken.",
"caption": "No Action"
},
"17": {
"description": "The operation or action was logged without further action.",
"caption": "Logged"
},
"18": {
"description": "A file or other entity was marked with extended attributes.",
"caption": "Tagged"
},
"20": {
"description": "Counted the request or activity but did not determine whether to allow it or block it.",
"caption": "Count"
},
"21": {
"description": "The request was detected as a threat and resulted in the connection being reset.",
"caption": "Reset"
},
"22": {
"description": "Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request.",
"caption": "Captcha"
},
"23": {
"description": "Ran a silent challenge that required the client session to verify that it's a browser, and not a bot.",
"caption": "Challenge"
},
"24": {
"description": "The requestor's access has been revoked due to security policy enforcements. Note: use the <code>Host</code> profile if the <code>User</code> or <code>Actor</code> requestor is not present in the event class.",
"caption": "Access Revoked"
},
"25": {
"description": "A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from <code>2</code> 'Blocked'.",
"caption": "Rejected"
},
"26": {
"description": "An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than <code>2</code> 'Blocked' and can be complemented with the <code>authorizations</code> attribute for more detail.",
"caption": "Unauthorized"
},
"27": {
"description": "An error occurred during the processing of the activity or request. Use the <code>message</code> attribute of the base class for details.",
"caption": "Error"
},
"13": {
"description": "A corrupt file or configuration was not corrected.",
"caption": "Uncorrected"
},
"19": {
"description": "The request or activity was detected as a threat and resulted in a notification but request was not blocked.",
"caption": "Alert"
}
},
"description": "Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.",
"group": "primary",
"requirement": "recommended",
"caption": "Disposition ID",
"type_name": "Integer",
"sibling": "disposition",
"_source": "base_event"
}
},
{
"type_name": {
"type": "string_t",
"description": "The event/finding type name, as defined by the type_uid.",
"group": "classification",
"requirement": "optional",
"caption": "Type Name",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "type_uid"
}
},
{
"end_time": {
"type": "timestamp_t",
"description": "The end time of a time period, or the time of the most recent event included in the aggregate event.",
"group": "occurrence",
"requirement": "optional",
"caption": "End Time",
"type_name": "Timestamp",
"_source": "base_event"
}
},
{
"count": {
"type": "integer_t",
"description": "The number of times that events in the same logical group occurred during the event <strong>Start Time</strong> to <strong>End Time</strong> period.",
"group": "occurrence",
"requirement": "optional",
"caption": "Count",
"type_name": "Integer",
"_source": "base_event"
}
},
{
"category_name": {
"type": "string_t",
"description": "The event category name, as defined by category_uid value.",
"group": "classification",
"requirement": "optional",
"caption": "Category",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "category_uid"
}
},
{
"unmapped": {
"type": "object_t",
"description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
"group": "context",
"requirement": "optional",
"caption": "Unmapped Data",
"object_name": "Object",
"object_type": "object",
"_source": "base_event"
}
},
{
"is_alert": {
"profile": "security_control",
"type": "boolean_t",
"description": "Indicates that the event is considered to be an alertable signal. Should be set to <code>true</code> if <code>disposition_id = Alert</code> among other dispositions, and/or <code>risk_level_id</code> or <code>severity_id</code> of the event is elevated. Not all control events will be alertable, for example if <code>disposition_id = Exonerated</code> or <code>disposition_id = Allowed</code>.",
"group": "primary",
"requirement": "recommended",
"caption": "Alert",
"type_name": "Boolean",
"_source": "base_event"
}
},
{
"type_uid": {
"type": "long_t",
"enum": {
"0": {
"caption": "Base Event: Unknown"
},
"99": {
"caption": "Base Event: Other"
}
},
"description": "The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: <code>class_uid * 100 + activity_id</code>.",
"group": "classification",
"requirement": "required",
"caption": "Type ID",
"type_name": "Long",
"sibling": "type_name",
"_source": "base_event"
}
},
{
"confidence_id": {
"profile": "security_control",
"type": "integer_t",
"enum": {
"3": {
"caption": "High"
},
"0": {
"description": "The normalized confidence is unknown.",
"caption": "Unknown"
},
"1": {
"caption": "Low"
},
"2": {
"caption": "Medium"
},
"99": {
"description": "The confidence is not mapped to the defined enum values. See the <code>confidence</code> attribute, which contains a data source specific value.",
"caption": "Other"
}
},
"description": "The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.",
"group": "context",
"requirement": "recommended",
"caption": "Confidence ID",
"type_name": "Integer",
"sibling": "confidence",
"_source": "base_event"
}
},
{
"category_uid": {
"type": "integer_t",
"enum": {
"0": {
"caption": "Uncategorized"
}
},
"description": "The category unique identifier of the event.",
"group": "classification",
"requirement": "required",
"caption": "Category ID",
"type_name": "Integer",
"sibling": "category_name",
"_source": "base_event"
}
},
{
"time": {
"type": "timestamp_t",
"description": "The normalized event occurrence time or the finding creation time.",
"group": "occurrence",
"requirement": "required",
"caption": "Event Time",
"type_name": "Timestamp",
"_source": "base_event"
}
},
{
"status": {
"type": "string_t",
"description": "The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.",
"group": "primary",
"requirement": "recommended",
"caption": "Status",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "status_id"
}
},
{
"duration": {
"type": "long_t",
"description": "The event duration or aggregate time, the amount of time the event covers from <code>start_time</code> to <code>end_time</code> in milliseconds.",
"group": "occurrence",
"requirement": "optional",
"caption": "Duration Milliseconds",
"type_name": "Long",
"_source": "base_event"
}
},
{
"malware": {
"profile": "security_control",
"type": "object_t",
"description": "A list of Malware objects, describing details about the identified malware.",
"group": "primary",
"is_array": true,
"requirement": "optional",
"caption": "Malware",
"object_name": "Malware",
"object_type": "malware",
"_source": "base_event"
}
},
{
"metadata": {
"type": "object_t",
"description": "The metadata associated with the event or a finding.",
"group": "context",
"requirement": "required",
"caption": "Metadata",
"object_name": "Metadata",
"object_type": "metadata",
"_source": "base_event"
}
},
{
"confidence_score": {
"profile": "security_control",
"type": "integer_t",
"description": "The confidence score as reported by the event source.",
"group": "context",
"requirement": "optional",
"caption": "Confidence Score",
"type_name": "Integer",
"_source": "base_event"
}
},
{
"enrichments": {
"type": "object_t",
"description": "The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:</p><code>[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]</code>",
"group": "context",
"is_array": true,
"requirement": "optional",
"caption": "Enrichments",
"object_name": "Enrichment",
"object_type": "enrichment",
"_source": "base_event"
}
},
{
"status_id": {
"type": "integer_t",
"enum": {
"0": {
"description": "The status is unknown.",
"caption": "Unknown"
},
"1": {
"caption": "Success"
},
"2": {
"caption": "Failure"
},
"99": {
"description": "The status is not mapped. See the <code>status</code> attribute, which contains a data source specific value.",
"caption": "Other"
}
},
"description": "The normalized identifier of the event status.",
"group": "primary",
"requirement": "recommended",
"caption": "Status ID",
"type_name": "Integer",
"sibling": "status",
"_source": "base_event"
}
},
{
"class_name": {
"type": "string_t",
"description": "The event class name, as defined by class_uid value: <code>Base Event</code>.",
"group": "classification",
"requirement": "optional",
"caption": "Class",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "class_uid"
}
},
{
"status_detail": {
"type": "string_t",
"description": "The status detail contains additional information about the event/finding outcome.",
"group": "primary",
"requirement": "recommended",
"caption": "Status Detail",
"type_name": "String",
"_source": "base_event"
}
},
{
"message": {
"type": "string_t",
"description": "The description of the event/finding, as defined by the source.",
"group": "primary",
"requirement": "recommended",
"caption": "Message",
"type_name": "String",
"_source": "base_event"
}
},
{
"end_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The end time of a time period, or the time of the most recent event included in the aggregate event.",
"group": "occurrence",
"requirement": "optional",
"caption": "End Time",
"type_name": "Datetime",
"_source": "base_event"
}
},
{
"api": {
"profile": "cloud",
"type": "object_t",
"description": "Describes details about a typical API (Application Programming Interface) call.",
"group": "context",
"requirement": "optional",
"caption": "API Details",
"object_name": "API",
"object_type": "api",
"_source": "base_event"
}
},
{
"device": {
"profile": "host",
"type": "object_t",
"description": "An addressable device, computer system or host.",
"group": "primary",
"requirement": "recommended",
"caption": "Device",
"object_name": "Device",
"object_type": "device",
"_source": "base_event"
}
},
{
"action": {
"profile": "security_control",
"type": "string_t",
"description": "The normalized caption of <code>action_id</code>.",
"group": "primary",
"requirement": "optional",
"caption": "Action",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "action_id"
}
},
{
"severity_id": {
"type": "integer_t",
"enum": {
"3": {
"description": "Action is required but the situation is not serious at this time.",
"caption": "Medium"
},
"6": {
"description": "An error occurred but it is too late to take remedial action.",
"caption": "Fatal"
},
"0": {
"description": "The event/finding severity is unknown.",
"caption": "Unknown"
},
"1": {
"description": "Informational message. No action required.",
"caption": "Informational"
},
"2": {
"description": "The user decides if action is needed.",
"caption": "Low"
},
"99": {
"description": "The event/finding severity is not mapped. See the <code>severity</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "Action is required immediately.",
"caption": "High"
},
"5": {
"description": "Action is required immediately and the scope is broad.",
"caption": "Critical"
}
},
"description": "<p>The normalized identifier of the event/finding severity.</p>The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.",
"group": "classification",
"requirement": "required",
"caption": "Severity ID",
"type_name": "Integer",
"sibling": "severity",
"_source": "base_event"
}
},
{
"attacks": {
"profile": "security_control",
"type": "object_t",
"description": "An array of MITRE ATT&CK\u00ae objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS\u2122 tactics, techniques & sub-techniques.",
"group": "primary",
"is_array": true,
"references": [
{
"description": "MITRE ATT&CK\u00ae",
"url": "https://attack.mitre.org"
},
{
"description": "MITRE ATLAS",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"requirement": "optional",
"caption": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details",
"object_name": "MITRE ATT&CK\u00ae & ATLAS\u2122",
"object_type": "attack",
"_source": "base_event"
}
},
{
"timezone_offset": {
"type": "integer_t",
"description": "The number of minutes that the reported event <code>time</code> is ahead or behind UTC, in the range -1,080 to +1,080.",
"group": "occurrence",
"requirement": "recommended",
"caption": "Timezone Offset",
"type_name": "Integer",
"_source": "base_event"
}
},
{
"activity_id": {
"type": "integer_t",
"enum": {
"0": {
"description": "The event activity is unknown.",
"caption": "Unknown"
},
"99": {
"description": "The event activity is not mapped. See the <code>activity_name</code> attribute, which contains a data source specific value.",
"caption": "Other"
}
},
"description": "The normalized identifier of the activity that triggered the event.",
"group": "classification",
"requirement": "required",
"caption": "Activity ID",
"type_name": "Integer",
"sibling": "activity_name",
"_source": "base_event",
"suppress_checks": [
"sibling_convention"
]
}
},
{
"malware_scan_info": {
"profile": "security_control",
"type": "object_t",
"description": "Describes details about the scan job that identified malware on the target system.",
"group": "primary",
"requirement": "optional",
"caption": "Malware Scan Info",
"object_name": "Malware Scan Info",
"object_type": "malware_scan_info",
"_source": "base_event"
}
},
{
"class_uid": {
"type": "integer_t",
"enum": {
"0": {
"description": "The base event is a generic and concrete event. It also defines a set of attributes available in most event classes. As a generic event that does not belong to any event category, it could be used to log events that are not otherwise defined by the schema.",
"caption": "Base Event"
}
},
"description": "The unique identifier of a class. A class describes the attributes available in an event.",
"group": "classification",
"requirement": "required",
"caption": "Class ID",
"type_name": "Integer",
"sibling": "class_name",
"_source": "base_event"
}
},
{
"risk_score": {
"profile": "security_control",
"type": "integer_t",
"description": "The risk score as reported by the event source.",
"group": "context",
"requirement": "optional",
"caption": "Risk Score",
"type_name": "Integer",
"_source": "base_event"
}
},
{
"raw_data_size": {
"type": "long_t",
"description": "The size of the raw data which was transformed into an OCSF event, in bytes.",
"group": "context",
"requirement": "optional",
"caption": "Raw Data Size",
"type_name": "Long",
"_source": "base_event"
}
},
{
"observables": {
"type": "object_t",
"description": "The observables associated with the event or a finding.",
"group": "primary",
"is_array": true,
"references": [
{
"description": "OCSF Observables FAQ",
"url": "https://github.com/ocsf/ocsf-docs/blob/main/articles/defining-and-using-observables.md"
}
],
"requirement": "recommended",
"caption": "Observables",
"object_name": "Observable",
"object_type": "observable",
"_source": "base_event"
}
},
{
"disposition": {
"profile": "security_control",
"type": "string_t",
"description": "The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.",
"group": "primary",
"requirement": "optional",
"caption": "Disposition",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "disposition_id"
}
},
{
"activity_name": {
"type": "string_t",
"description": "The event activity name, as defined by the activity_id.",
"group": "classification",
"requirement": "optional",
"caption": "Activity",
"type_name": "String",
"_source": "base_event",
"_sibling_of": "activity_id"
}
},
{
"cloud": {
"profile": "cloud",
"type": "object_t",
"description": "Describes details about the Cloud environment where the event or finding was created.",
"group": "primary",
"requirement": "required",
"caption": "Cloud",
"object_name": "Cloud",
"object_type": "cloud",
"_source": "base_event"
}
},
{
"actor": {
"profile": "host",
"type": "object_t",
"description": "The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign.",
"group": "primary",
"requirement": "optional",
"caption": "Actor",
"object_name": "Actor",
"object_type": "actor",
"_source": "base_event"
}
},
{
"raw_data": {
"type": "string_t",
"description": "The raw event/finding data as received from the source.",
"group": "context",
"requirement": "optional",
"caption": "Raw Data",
"type_name": "String",
"_source": "base_event"
}
},
{
"start_time": {
"type": "timestamp_t",
"description": "The start time of a time period, or the time of the least recent event included in the aggregate event.",
"group": "occurrence",
"requirement": "optional",
"caption": "Start Time",
"type_name": "Timestamp",
"_source": "base_event"
}
}
],
"name": "base_event",
"description": "The base event is a generic and concrete event. It also defines a set of attributes available in most event classes. As a generic event that does not belong to any event category, it could be used to log events that are not otherwise defined by the schema.",
"uid": 0,
"category": "other",
"profiles": [
"cloud",
"datetime",
"host",
"osint",
"security_control"
],
"category_uid": 0,
"caption": "Base Event"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/classes/detection_finding.json
Generated
-1397
View File
File diff suppressed because it is too large Load Diff
crates/openshell-ocsf/schemas/ocsf/v1.7.0/classes/device_config_state_change.json
Generated
-1137
View File
File diff suppressed because it is too large Load Diff
crates/openshell-ocsf/schemas/ocsf/v1.7.0/classes/http_activity.json
Generated
-1380
View File
File diff suppressed because it is too large Load Diff
crates/openshell-ocsf/schemas/ocsf/v1.7.0/classes/network_activity.json
Generated
-1309
View File
File diff suppressed because it is too large Load Diff
crates/openshell-ocsf/schemas/ocsf/v1.7.0/classes/process_activity.json
Generated
-1193
View File
File diff suppressed because it is too large Load Diff
crates/openshell-ocsf/schemas/ocsf/v1.7.0/classes/ssh_activity.json
Generated
-1391
View File
File diff suppressed because it is too large Load Diff
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/actor.json
Generated
-118
View File
@@ -1,118 +0,0 @@
{
"attributes": [
{
"process": {
"type": "object_t",
"description": "The process that initiated the activity.",
"requirement": "recommended",
"caption": "Process",
"object_name": "Process",
"object_type": "process",
"_source": "actor"
}
},
{
"session": {
"type": "object_t",
"description": "The user session from which the activity was initiated.",
"requirement": "optional",
"caption": "Session",
"object_name": "Session",
"object_type": "session",
"_source": "actor"
}
},
{
"user": {
"type": "object_t",
"description": "The user that initiated the activity or the user context from which the activity was initiated.",
"requirement": "recommended",
"caption": "User",
"object_name": "User",
"object_type": "user",
"_source": "actor"
}
},
{
"app_name": {
"type": "string_t",
"description": "The client application or service that initiated the activity. This can be in conjunction with the <code>user</code> if present. Note that <code>app_name</code> is distinct from the <code>process</code> if present.",
"requirement": "optional",
"caption": "Application Name",
"type_name": "String",
"_source": "actor"
}
},
{
"app_uid": {
"type": "string_t",
"description": "The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the <code>user</code> if present. Note that <code>app_name</code> is distinct from the <code>process.pid</code> or <code>process.uid</code> if present.",
"requirement": "optional",
"caption": "Application ID",
"type_name": "String",
"_source": "actor"
}
},
{
"authorizations": {
"type": "object_t",
"description": "Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.",
"is_array": true,
"requirement": "optional",
"caption": "Authorization Information",
"object_name": "Authorization Result",
"object_type": "authorization",
"_source": "actor"
}
},
{
"idp": {
"type": "object_t",
"description": "This object describes details about the Identity Provider used.",
"requirement": "optional",
"caption": "Identity Provider",
"object_name": "Identity Provider",
"object_type": "idp",
"_source": "actor"
}
},
{
"invoked_by": {
"type": "string_t",
"description": "The name of the service that invoked the activity as described in the event.",
"requirement": "optional",
"caption": "Invoked by",
"type_name": "String",
"@deprecated": {
"message": "Use <code> app_name, app_uid </code> attributes instead.",
"since": "1.2.0"
},
"_source": "actor"
}
}
],
"name": "actor",
"description": "The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity. Note that Actor is not the threat actor of a campaign but may be part of a campaign.",
"extends": "object",
"constraints": {
"at_least_one": [
"process",
"user",
"invoked_by",
"session",
"app_name",
"app_uid"
]
},
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:Agent.",
"url": "https://next.d3fend.mitre.org/agent/d3f:Agent/"
}
],
"profiles": [
"container",
"linux/linux_users"
],
"caption": "Actor"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/attack.json
Generated
-135
View File
@@ -1,135 +0,0 @@
{
"attributes": [
{
"version": {
"type": "string_t",
"description": "The ATT&CK\u00ae or ATLAS\u2122 Matrix version.",
"requirement": "recommended",
"caption": "Version",
"type_name": "String",
"_source": "attack"
}
},
{
"tactics": {
"type": "object_t",
"description": "The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by <a target='_blank' href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK\u00ae Matrix</a>.",
"is_array": true,
"requirement": "optional",
"caption": "Tactics",
"object_name": "MITRE Tactic",
"object_type": "tactic",
"@deprecated": {
"message": "Use the <code>tactic</code> attribute instead.",
"since": "1.1.0"
},
"_source": "attack"
}
},
{
"technique": {
"type": "object_t",
"description": "The Technique object describes the MITRE ATT&CK\u00ae or ATLAS\u2122 Technique ID and/or name associated to an attack.",
"references": [
{
"description": "ATT&CK\u00ae Matrix",
"url": "https://attack.mitre.org/wiki/ATT&CK_Matrix"
},
{
"description": "ATLAS\u2122 Matrix",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"requirement": "recommended",
"caption": "MITRE Technique",
"object_name": "MITRE Technique",
"object_type": "technique",
"_source": "attack"
}
},
{
"mitigation": {
"type": "object_t",
"description": "The Mitigation object describes the MITRE ATT&CK\u00ae or ATLAS\u2122 Mitigation ID and/or name that is associated to an attack.",
"references": [
{
"description": "ATT&CK\u00ae Matrix",
"url": "https://attack.mitre.org/wiki/ATT&CK_Matrix"
},
{
"description": "ATLAS\u2122 Matrix",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"requirement": "optional",
"caption": "MITRE Mitigation",
"object_name": "MITRE Mitigation",
"object_type": "mitigation",
"_source": "attack"
}
},
{
"sub_technique": {
"type": "object_t",
"description": "The Sub-technique object describes the MITRE ATT&CK\u00ae or ATLAS\u2122 Sub-technique ID and/or name associated to an attack.",
"references": [
{
"description": "ATT&CK\u00ae Matrix",
"url": "https://attack.mitre.org/wiki/ATT&CK_Matrix"
},
{
"description": "ATLAS\u2122 Matrix",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"requirement": "recommended",
"caption": "MITRE Sub-technique",
"object_name": "MITRE Sub-technique",
"object_type": "sub_technique",
"_source": "attack"
}
},
{
"tactic": {
"type": "object_t",
"description": "The Tactic object describes the MITRE ATT&CK\u00ae or ATLAS\u2122 Tactic ID and/or name that is associated to an attack.",
"references": [
{
"description": "ATT&CK\u00ae Matrix",
"url": "https://attack.mitre.org/wiki/ATT&CK_Matrix"
},
{
"description": "ATLAS\u2122 Matrix",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"requirement": "recommended",
"caption": "MITRE Tactic",
"object_name": "MITRE Tactic",
"object_type": "tactic",
"_source": "attack"
}
}
],
"name": "attack",
"description": "The MITRE ATT&CK\u00ae & ATLAS\u2122 object describes the tactic, technique, sub-technique & mitigation associated to an attack.",
"extends": "object",
"constraints": {
"at_least_one": [
"tactic",
"technique",
"sub_technique"
]
},
"references": [
{
"description": "ATT&CK\u00ae Matrix",
"url": "https://attack.mitre.org/wiki/ATT&CK_Matrix"
},
{
"description": "ATLAS\u2122 Matrix",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"caption": "MITRE ATT&CK\u00ae & ATLAS\u2122"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/connection_info.json
Generated
-3
View File
@@ -1,3 +0,0 @@
{
"error": "Object connection_info not found"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/container.json
Generated
-150
View File
@@ -1,150 +0,0 @@
{
"attributes": [
{
"name": {
"type": "string_t",
"description": "The container name.",
"requirement": "recommended",
"caption": "Name",
"type_name": "String",
"_source": "container"
}
},
{
"runtime": {
"type": "string_t",
"description": "The backend running the container, such as containerd or cri-o.",
"requirement": "optional",
"caption": "Runtime",
"type_name": "String",
"_source": "container"
}
},
{
"size": {
"type": "long_t",
"description": "The size of the container image.",
"requirement": "recommended",
"caption": "Size",
"type_name": "Long",
"_source": "container"
}
},
{
"tag": {
"type": "string_t",
"description": "The tag used by the container. It can indicate version, format, OS.",
"requirement": "optional",
"caption": "Image Tag",
"type_name": "String",
"@deprecated": {
"message": "Use the <code>labels or tags</code> attribute instead.",
"since": "1.4.0"
},
"_source": "container"
}
},
{
"uid": {
"type": "string_t",
"description": "The full container unique identifier for this instantiation of the container. For example: <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String",
"_source": "container"
}
},
{
"image": {
"type": "object_t",
"description": "The container image used as a template to run the container.",
"requirement": "recommended",
"caption": "Image",
"object_name": "Image",
"object_type": "image",
"_source": "container"
}
},
{
"hash": {
"type": "object_t",
"description": "Commit hash of image created for docker or the SHA256 hash of the container. For example: <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.",
"requirement": "recommended",
"caption": "Hash",
"object_name": "Fingerprint",
"object_type": "fingerprint",
"_source": "container"
}
},
{
"labels": {
"type": "string_t",
"description": "The list of labels associated to the container.",
"is_array": true,
"requirement": "optional",
"caption": "Labels",
"type_name": "String",
"_source": "container"
}
},
{
"tags": {
"type": "object_t",
"description": "The list of tags; <code>{key:value}</code> pairs associated to the container.",
"is_array": true,
"requirement": "optional",
"caption": "Tags",
"object_name": "Key:Value object",
"object_type": "key_value_object",
"_source": "container"
}
},
{
"network_driver": {
"type": "string_t",
"description": "The network driver used by the container. For example, bridge, overlay, host, none, etc.",
"requirement": "optional",
"caption": "Network Driver",
"type_name": "String",
"_source": "container"
}
},
{
"orchestrator": {
"type": "string_t",
"description": "The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift.",
"requirement": "optional",
"caption": "Orchestrator",
"type_name": "String",
"_source": "container"
}
},
{
"pod_uuid": {
"type": "uuid_t",
"description": "The unique identifier of the pod (or equivalent) that the container is executing on.",
"requirement": "optional",
"caption": "Pod UUID",
"type_name": "UUID",
"_source": "container"
}
}
],
"name": "container",
"description": "The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.",
"extends": "object",
"constraints": {
"at_least_one": [
"uid",
"name"
]
},
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:ContainerProcess.",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:ContainerProcess/"
}
],
"caption": "Container",
"observable": 27
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/device.json
Generated
-798
View File
@@ -1,798 +0,0 @@
{
"attributes": [
{
"boot_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time the system was booted.",
"requirement": "optional",
"caption": "Boot Time",
"type_name": "Datetime",
"_source": "device"
}
},
{
"risk_level": {
"type": "string_t",
"description": "The risk level, normalized to the caption of the risk_level_id value.",
"requirement": "optional",
"caption": "Risk Level",
"type_name": "String",
"_source": "device",
"_sibling_of": "risk_level_id"
}
},
{
"vendor_name": {
"type": "string_t",
"description": "The vendor for the device. For example <code>Dell</code> or <code>Lenovo</code>.",
"requirement": "recommended",
"caption": "Vendor Name",
"type_name": "String",
"_source": "device"
}
},
{
"type_id": {
"type": "integer_t",
"enum": {
"3": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/'>laptop computer</a>.",
"caption": "Laptop"
},
"6": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/'>virtual machine</a>.",
"caption": "Virtual"
},
"0": {
"description": "The type is unknown.",
"caption": "Unknown"
},
"1": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Server/'>server</a>.",
"caption": "Server"
},
"2": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/'>desktop computer</a>.",
"caption": "Desktop"
},
"99": {
"description": "The type is not mapped. See the <code>type</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/'>tablet computer</a>.",
"caption": "Tablet"
},
"5": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/'>mobile phone</a>.",
"caption": "Mobile"
},
"7": {
"description": "An <a target='_blank' href='https://www.techtarget.com/iotagenda/definition/IoT-device'>IOT (Internet of Things) device</a>.",
"caption": "IOT"
},
"8": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Browser/'>web browser</a>.",
"caption": "Browser"
},
"9": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Firewall/'>networking firewall</a>.",
"caption": "Firewall"
},
"10": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Switch/'>networking switch</a>.",
"caption": "Switch"
},
"11": {
"description": "A <a target='_blank' href='https://en.wikipedia.org/wiki/Ethernet_hub'>networking hub</a>.",
"caption": "Hub"
},
"12": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Router/'>networking router</a>.",
"caption": "Router"
},
"14": {
"description": "An <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/'>intrusion prevention system</a>.",
"caption": "IPS"
},
"15": {
"description": "A <a target='_blank' href='https://en.wikipedia.org/wiki/Load_balancing_(computing)'>Load Balancer device.</a>",
"caption": "Load Balancer"
},
"13": {
"description": "An <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/'>intrusion detection system</a>.",
"caption": "IDS"
}
},
"description": "The device type ID.",
"requirement": "required",
"caption": "Type ID",
"type_name": "Integer",
"sibling": "type",
"_source": "device"
}
},
{
"imei_list": {
"type": "string_t",
"description": "The International Mobile Equipment Identity values that are associated with the device.",
"is_array": true,
"requirement": "optional",
"caption": "IMEI List",
"type_name": "String",
"_source": "device"
}
},
{
"first_seen_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The initial discovery time of the device.",
"requirement": "optional",
"caption": "First Seen",
"type_name": "Datetime",
"_source": "device"
}
},
{
"org": {
"type": "object_t",
"description": "Organization and org unit related to the device.",
"requirement": "optional",
"caption": "Organization",
"object_name": "Organization",
"object_type": "organization",
"_source": "device"
}
},
{
"type": {
"type": "string_t",
"description": "The device type. For example: <code>unknown</code>, <code>server</code>, <code>desktop</code>, <code>laptop</code>, <code>tablet</code>, <code>mobile</code>, <code>virtual</code>, <code>browser</code>, or <code>other</code>.",
"requirement": "recommended",
"caption": "Type",
"type_name": "String",
"_source": "device",
"_sibling_of": "type_id"
}
},
{
"interface_uid": {
"type": "string_t",
"description": "The unique identifier of the network interface.",
"requirement": "recommended",
"caption": "Network Interface ID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"is_trusted": {
"type": "boolean_t",
"description": "The event occurred on a trusted device.",
"requirement": "optional",
"caption": "Trusted Device",
"type_name": "Boolean",
"_source": "device"
}
},
{
"is_shared": {
"type": "boolean_t",
"description": "The event occurred on a shared device.",
"requirement": "optional",
"caption": "Shared Device",
"type_name": "Boolean",
"_source": "device"
}
},
{
"boot_uid": {
"type": "string_t",
"description": "A unique identifier of the device that changes after every reboot. For example, the value of <code>/proc/sys/kernel/random/boot_id</code> from Linux's procfs.",
"references": [
{
"description": "Linux kernel's documentation",
"url": "https://docs.kernel.org/admin-guide/sysctl/kernel.html#random"
}
],
"requirement": "optional",
"caption": "Boot UID",
"type_name": "String",
"_source": "device"
}
},
{
"subnet": {
"type": "subnet_t",
"description": "The subnet mask.",
"requirement": "optional",
"caption": "Subnet",
"type_name": "Subnet",
"_source": "device"
}
},
{
"name": {
"type": "string_t",
"description": "The alternate device name, ordinarily as assigned by an administrator. <p><b>Note:</b> The <b>Name</b> could be any other string that helps to identify the device, such as a phone number; for example <code>310-555-1234</code>.</p>",
"requirement": "optional",
"caption": "Name",
"type_name": "String",
"_source": "device"
}
},
{
"region": {
"type": "string_t",
"description": "The region where the virtual machine is located. For example, an AWS Region.",
"requirement": "recommended",
"caption": "Region",
"type_name": "String",
"_source": "device"
}
},
{
"udid": {
"type": "string_t",
"description": "The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS, tvOS, watchOS and visionOS devices, this is the UDID. For macOS devices, it is the Provisioning UDID. For example: <code>00008020-008D4548007B4F26</code>",
"references": [
{
"description": "Apple Wiki",
"url": "https://theapplewiki.com/wiki/UDID"
}
],
"requirement": "optional",
"caption": "Unique Device Identifier",
"type_name": "String",
"_source": "device"
}
},
{
"last_seen_time": {
"type": "timestamp_t",
"description": "The most recent discovery time of the device.",
"requirement": "optional",
"caption": "Last Seen",
"type_name": "Timestamp",
"_source": "device"
}
},
{
"modified_time": {
"type": "timestamp_t",
"description": "The time when the device was last known to have been modified.",
"requirement": "optional",
"caption": "Modified Time",
"type_name": "Timestamp",
"_source": "device"
}
},
{
"risk_level_id": {
"type": "integer_t",
"enum": {
"3": {
"caption": "High"
},
"0": {
"caption": "Info"
},
"1": {
"caption": "Low"
},
"2": {
"caption": "Medium"
},
"99": {
"description": "The risk level is not mapped. See the <code>risk_level</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"caption": "Critical"
}
},
"description": "The normalized risk level id.",
"requirement": "optional",
"caption": "Risk Level ID",
"type_name": "Integer",
"sibling": "risk_level",
"_source": "device",
"suppress_checks": [
"enum_convention"
]
}
},
{
"created_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the device was known to have been created.",
"requirement": "optional",
"caption": "Created Time",
"type_name": "Datetime",
"_source": "device"
}
},
{
"is_mobile_account_active": {
"type": "boolean_t",
"description": "Indicates whether the device has an active mobile account. For example, this is indicated by the <code>itunesStoreAccountActive</code> value within JAMF Pro mobile devices.",
"requirement": "optional",
"caption": "Mobile Account Active",
"type_name": "Boolean",
"_source": "device"
}
},
{
"hostname": {
"type": "hostname_t",
"description": "The device hostname.",
"requirement": "recommended",
"caption": "Hostname",
"type_name": "Hostname",
"_source": "device"
}
},
{
"modified_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the device was last known to have been modified.",
"requirement": "optional",
"caption": "Modified Time",
"type_name": "Datetime",
"_source": "device"
}
},
{
"mac": {
"type": "mac_t",
"description": "The Media Access Control (MAC) address of the endpoint.",
"requirement": "optional",
"caption": "MAC Address",
"type_name": "MAC Address",
"_source": "endpoint"
}
},
{
"instance_uid": {
"type": "string_t",
"description": "The unique identifier of a VM instance.",
"requirement": "recommended",
"caption": "Instance ID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"domain": {
"type": "string_t",
"description": "The network domain where the device resides. For example: <code>work.example.com</code>.",
"requirement": "optional",
"caption": "Domain",
"type_name": "String",
"_source": "device"
}
},
{
"hw_info": {
"type": "object_t",
"description": "The endpoint hardware information.",
"requirement": "optional",
"caption": "Hardware Info",
"object_name": "Device Hardware Info",
"object_type": "device_hw_info",
"_source": "endpoint"
}
},
{
"agent_list": {
"type": "object_t",
"description": "A list of <code>agent</code> objects associated with a device, endpoint, or resource.",
"is_array": true,
"requirement": "optional",
"caption": "Agent List",
"object_name": "Agent",
"object_type": "agent",
"_source": "endpoint"
}
},
{
"autoscale_uid": {
"type": "string_t",
"description": "The unique identifier of the cloud autoscale configuration.",
"requirement": "optional",
"caption": "Autoscale UID",
"type_name": "String",
"_source": "device"
}
},
{
"imei": {
"type": "string_t",
"description": "The International Mobile Equipment Identity that is associated with the device.",
"requirement": "optional",
"caption": "IMEI",
"type_name": "String",
"@deprecated": {
"message": "Use the <code>imei_list</code> attribute instead.",
"since": "1.4.0"
},
"_source": "device"
}
},
{
"uid_alt": {
"type": "string_t",
"description": "An alternate unique identifier of the device if any. For example the ActiveDirectory DN.",
"requirement": "optional",
"caption": "Alternate ID",
"type_name": "String",
"_source": "device"
}
},
{
"first_seen_time": {
"type": "timestamp_t",
"description": "The initial discovery time of the device.",
"requirement": "optional",
"caption": "First Seen",
"type_name": "Timestamp",
"_source": "device"
}
},
{
"is_supervised": {
"type": "boolean_t",
"description": "The event occurred on a supervised device. Devices that are supervised are typically mobile devices managed by a Mobile Device Management solution and are restricted from specific behaviors such as Apple AirDrop.",
"requirement": "optional",
"caption": "Supervised Device",
"type_name": "Boolean",
"_source": "device"
}
},
{
"ip": {
"type": "ip_t",
"description": "The device IP address, in either IPv4 or IPv6 format.",
"requirement": "optional",
"caption": "IP Address",
"type_name": "IP Address",
"_source": "device"
}
},
{
"image": {
"type": "object_t",
"description": "The image used as a template to run the virtual machine.",
"requirement": "optional",
"caption": "Image",
"object_name": "Image",
"object_type": "image",
"_source": "device"
}
},
{
"namespace_pid": {
"profile": "container",
"type": "integer_t",
"description": "If running under a process namespace (such as in a container), the process identifier within that process namespace.",
"group": "context",
"requirement": "recommended",
"caption": "Namespace PID",
"type_name": "Integer",
"_source": "endpoint"
}
},
{
"is_personal": {
"type": "boolean_t",
"description": "The event occurred on a personal device.",
"requirement": "optional",
"caption": "Personal Device",
"type_name": "Boolean",
"_source": "device"
}
},
{
"is_compliant": {
"type": "boolean_t",
"description": "The event occurred on a compliant device.",
"requirement": "optional",
"caption": "Compliant Device",
"type_name": "Boolean",
"_source": "device"
}
},
{
"boot_time": {
"type": "timestamp_t",
"description": "The time the system was booted.",
"requirement": "optional",
"caption": "Boot Time",
"type_name": "Timestamp",
"_source": "device"
}
},
{
"vpc_uid": {
"type": "string_t",
"description": "The unique identifier of the Virtual Private Cloud (VPC).",
"requirement": "optional",
"caption": "VPC UID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"meid": {
"type": "string_t",
"description": "The Mobile Equipment Identifier. It's a unique number that identifies a Code Division Multiple Access (CDMA) mobile device.",
"requirement": "optional",
"caption": "MEID",
"type_name": "String",
"_source": "device"
}
},
{
"vlan_uid": {
"type": "string_t",
"description": "The Virtual LAN identifier.",
"requirement": "optional",
"caption": "VLAN",
"type_name": "String",
"_source": "endpoint"
}
},
{
"os": {
"type": "object_t",
"description": "The endpoint operating system.",
"requirement": "optional",
"caption": "OS",
"object_name": "Operating System (OS)",
"object_type": "os",
"_source": "endpoint"
}
},
{
"os_machine_uuid": {
"type": "uuid_t",
"description": "The operating system assigned Machine ID. In Windows, this is the value stored at the registry path: <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid</code>. In Linux, this is stored in the file: <code>/etc/machine-id</code>.",
"requirement": "optional",
"caption": "OS Machine UUID",
"type_name": "UUID",
"_source": "device"
}
},
{
"uid": {
"type": "string_t",
"description": "The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String",
"observable": 47,
"_source": "device"
}
},
{
"owner": {
"type": "object_t",
"description": "The identity of the service or user account that owns the endpoint or was last logged into it.",
"requirement": "recommended",
"caption": "Owner",
"object_name": "User",
"object_type": "user",
"_source": "endpoint"
}
},
{
"model": {
"type": "string_t",
"description": "The model of the device. For example <code>ThinkPad X1 Carbon</code>.",
"requirement": "optional",
"caption": "Model",
"type_name": "String",
"_source": "device"
}
},
{
"network_interfaces": {
"type": "object_t",
"description": "The physical or virtual network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.<p><b>Note:</b> The first element of the array is the network information that pertains to the event.</p>",
"is_array": true,
"requirement": "optional",
"caption": "Network Interfaces",
"object_name": "Network Interface",
"object_type": "network_interface",
"_source": "device"
}
},
{
"desc": {
"type": "string_t",
"description": "The description of the device, ordinarily as reported by the operating system.",
"requirement": "optional",
"caption": "Description",
"type_name": "String",
"_source": "device"
}
},
{
"created_time": {
"type": "timestamp_t",
"description": "The time when the device was known to have been created.",
"requirement": "optional",
"caption": "Created Time",
"type_name": "Timestamp",
"_source": "device"
}
},
{
"last_seen_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The most recent discovery time of the device.",
"requirement": "optional",
"caption": "Last Seen",
"type_name": "Datetime",
"_source": "device"
}
},
{
"iccid": {
"type": "string_t",
"description": "The Integrated Circuit Card Identification of a mobile device. Typically it is a unique 18 to 22 digit number that identifies a SIM card.",
"requirement": "optional",
"caption": "ICCID",
"type_name": "String",
"_source": "device"
}
},
{
"container": {
"profile": "container",
"type": "object_t",
"description": "The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.",
"group": "context",
"requirement": "recommended",
"caption": "Container",
"object_name": "Container",
"object_type": "container",
"_source": "endpoint"
}
},
{
"subnet_uid": {
"type": "string_t",
"description": "The unique identifier of a virtual subnet.",
"requirement": "optional",
"caption": "Subnet UID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"zone": {
"type": "string_t",
"description": "The network zone or LAN segment.",
"requirement": "optional",
"caption": "Network Zone",
"type_name": "String",
"_source": "endpoint"
}
},
{
"eid": {
"type": "string_t",
"description": "An Embedded Identity Document, is a unique serial number that identifies an eSIM-enabled device.",
"requirement": "optional",
"caption": "EID",
"type_name": "String",
"_source": "device"
}
},
{
"hypervisor": {
"type": "string_t",
"description": "The name of the hypervisor running on the device. For example, <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>, <code>VirtualBox</code>, etc.",
"requirement": "optional",
"caption": "Hypervisor",
"type_name": "String",
"_source": "device"
}
},
{
"interface_name": {
"type": "string_t",
"description": "The name of the network interface (e.g. eth2).",
"requirement": "recommended",
"caption": "Network Interface Name",
"type_name": "String",
"_source": "endpoint"
}
},
{
"risk_score": {
"type": "integer_t",
"description": "The risk score as reported by the event source.",
"requirement": "optional",
"caption": "Risk Score",
"type_name": "Integer",
"_source": "device"
}
},
{
"location": {
"type": "object_t",
"description": "The geographical location of the device.",
"requirement": "optional",
"caption": "Geo Location",
"object_name": "Geo Location",
"object_type": "location",
"_source": "device"
}
},
{
"groups": {
"type": "object_t",
"description": "The group names to which the device belongs. For example: <code>[\"Windows Laptops\", \"Engineering\"]</code>.",
"is_array": true,
"requirement": "optional",
"caption": "Groups",
"object_name": "Group",
"object_type": "group",
"_source": "device"
}
},
{
"is_managed": {
"type": "boolean_t",
"description": "The event occurred on a managed device.",
"requirement": "optional",
"caption": "Managed Device",
"type_name": "Boolean",
"_source": "device"
}
},
{
"is_backed_up": {
"type": "boolean_t",
"description": "Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the <code>cloudBackupEnabled</code> value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service.",
"requirement": "optional",
"caption": "Back Ups Configured",
"type_name": "Boolean",
"_source": "device"
}
}
],
"name": "device",
"description": "The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network.",
"extends": "endpoint",
"constraints": {
"at_least_one": [
"ip",
"uid",
"name",
"hostname",
"instance_uid",
"interface_uid",
"interface_name"
]
},
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:Host.",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:Host/"
}
],
"profiles": [
"container",
"datetime"
],
"caption": "Device",
"observable": 20
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/evidences.json
Generated
-428
View File
@@ -1,428 +0,0 @@
{
"attributes": [
{
"data": {
"type": "json_t",
"description": "Additional evidence data that is not accounted for in the specific evidence attributes.<code> Use only when absolutely necessary.</code>",
"requirement": "optional",
"caption": "Data",
"type_name": "JSON",
"_source": "evidences"
}
},
{
"http_response": {
"type": "object_t",
"description": "Describes details about the http response associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "HTTP Response",
"object_name": "HTTP Response",
"object_type": "http_response",
"_source": "evidences"
}
},
{
"http_request": {
"type": "object_t",
"description": "Describes details about the http request associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "HTTP Request",
"object_name": "HTTP Request",
"object_type": "http_request",
"_source": "evidences"
}
},
{
"name": {
"type": "string_t",
"description": "The naming convention or type identifier of the evidence associated with the security detection. For example, the <code>@odata.type</code> from Microsoft Graph Alerts V2 or <code>display_name</code> from CrowdStrike Falcon Incident Behaviors.",
"requirement": "optional",
"caption": "Name",
"type_name": "String",
"_source": "evidences"
}
},
{
"process": {
"type": "object_t",
"description": "Describes details about the process associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Process",
"object_name": "Process",
"object_type": "process",
"_source": "evidences"
}
},
{
"file": {
"type": "object_t",
"description": "Describes details about the file associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "File",
"object_name": "File",
"object_type": "file",
"_source": "evidences"
}
},
{
"user": {
"type": "object_t",
"description": "Describes details about the user that was the target or somehow else associated with the activity that triggered the detection.",
"requirement": "recommended",
"caption": "User",
"object_name": "User",
"object_type": "user",
"_source": "evidences"
}
},
{
"script": {
"type": "object_t",
"description": "Describes details about the script that was associated with the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Script",
"object_name": "Script",
"object_type": "script",
"_source": "evidences"
}
},
{
"device": {
"type": "object_t",
"description": "An addressable device, computer system or host associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Device",
"object_name": "Device",
"object_type": "device",
"_source": "evidences"
}
},
{
"uid": {
"type": "string_t",
"description": "The unique identifier of the evidence associated with the security detection. For example, the <code>activity_id</code> from CrowdStrike Falcon Alerts or <code>behavior_id</code> from CrowdStrike Falcon Incident Behaviors.",
"requirement": "optional",
"caption": "Unique ID",
"type_name": "String",
"_source": "evidences"
}
},
{
"query": {
"type": "object_t",
"description": "Describes details about the DNS query associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "DNS Query",
"object_name": "DNS Query",
"object_type": "dns_query",
"_source": "evidences"
}
},
{
"connection_info": {
"type": "object_t",
"description": "Describes details about the network connection associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Connection Info",
"object_name": "Network Connection Information",
"object_type": "network_connection_info",
"_source": "evidences"
}
},
{
"url": {
"type": "object_t",
"description": "The URL object that pertains to the event or object associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "URL",
"object_name": "Uniform Resource Locator",
"object_type": "url",
"_source": "evidences"
}
},
{
"email": {
"type": "object_t",
"description": "The email object associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Email",
"object_name": "Email",
"object_type": "email",
"_source": "evidences"
}
},
{
"tls": {
"type": "object_t",
"description": "Describes details about the Transport Layer Security (TLS) activity that triggered the detection.",
"requirement": "recommended",
"caption": "TLS",
"object_name": "Transport Layer Security (TLS)",
"object_type": "tls",
"_source": "evidences"
}
},
{
"api": {
"type": "object_t",
"description": "Describes details about the API call associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "API Details",
"object_name": "API",
"object_type": "api",
"_source": "evidences"
}
},
{
"resources": {
"type": "object_t",
"description": "Describes details about the cloud resources directly related to activity that triggered the detection. For resources impacted by the detection, use <code>Affected Resources</code> at the top-level of the finding.",
"is_array": true,
"requirement": "recommended",
"caption": "Cloud Resources",
"object_name": "Resource Details",
"object_type": "resource_details",
"_source": "evidences"
}
},
{
"actor": {
"type": "object_t",
"description": "Describes details about the user/role/process that was the source of the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Actor",
"object_name": "Actor",
"object_type": "actor",
"_source": "evidences"
}
},
{
"container": {
"type": "object_t",
"description": "Describes details about the container associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Container",
"object_name": "Container",
"object_type": "container",
"_source": "evidences"
}
},
{
"database": {
"type": "object_t",
"description": "Describes details about the database associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Database",
"object_name": "Database",
"object_type": "database",
"_source": "evidences"
}
},
{
"databucket": {
"type": "object_t",
"description": "Describes details about the databucket associated to the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Databucket",
"object_name": "Databucket",
"object_type": "databucket",
"_source": "evidences"
}
},
{
"dst_endpoint": {
"type": "object_t",
"description": "Describes details about the destination of the network activity that triggered the detection.",
"requirement": "recommended",
"caption": "Destination Endpoint",
"object_name": "Network Endpoint",
"object_type": "network_endpoint",
"_source": "evidences"
}
},
{
"ja4_fingerprint_list": {
"type": "object_t",
"description": "Describes details about the JA4+ fingerprints that triggered the detection.",
"is_array": true,
"requirement": "recommended",
"caption": "JA4+ Fingerprints",
"object_name": "JA4+ Fingerprint",
"object_type": "ja4_fingerprint",
"_source": "evidences"
}
},
{
"job": {
"type": "object_t",
"description": "Describes details about the scheduled job that was associated with the activity that triggered the detection.",
"requirement": "recommended",
"caption": "Job",
"object_name": "Job",
"object_type": "job",
"_source": "evidences"
}
},
{
"src_endpoint": {
"type": "object_t",
"description": "Describes details about the source of the network activity that triggered the detection.",
"requirement": "recommended",
"caption": "Source Endpoint",
"object_name": "Network Endpoint",
"object_type": "network_endpoint",
"_source": "evidences"
}
},
{
"verdict": {
"type": "string_t",
"description": "The normalized verdict of the evidence associated with the security detection. ",
"requirement": "optional",
"caption": "Verdict",
"type_name": "String",
"_source": "evidences",
"_sibling_of": "verdict_id"
}
},
{
"verdict_id": {
"type": "integer_t",
"enum": {
"3": {
"description": "The verdict for the evidence is that is should be Disregarded.",
"caption": "Disregard"
},
"6": {
"description": "The evidence is part of a Test, or other sanctioned behavior(s).",
"caption": "Test"
},
"0": {
"description": "The type is unknown.",
"caption": "Unknown"
},
"1": {
"description": "The verdict for the evidence has been identified as a False Positive.",
"caption": "False Positive"
},
"2": {
"description": "The verdict for the evidence has been identified as a True Positive.",
"caption": "True Positive"
},
"99": {
"description": "The type is not mapped. See the <code>type</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "The verdict for the evidence is that the behavior has been identified as Suspicious.",
"caption": "Suspicious"
},
"5": {
"description": "The verdict for the evidence is that the behavior has been identified as Benign.",
"caption": "Benign"
},
"7": {
"description": "There is insufficient data to render a verdict on the evidence.",
"caption": "Insufficient Data"
},
"8": {
"description": "The verdict for the evidence is that the behavior has been identified as a Security Risk.",
"caption": "Security Risk"
},
"9": {
"description": "The verdict for the evidence is Managed Externally, such as in a case management tool.",
"caption": "Managed Externally"
},
"10": {
"description": "This evidence duplicates existing evidence related to this finding.",
"caption": "Duplicate"
}
},
"description": "The normalized verdict (or status) ID of the evidence associated with the security detection. For example, Microsoft Graph Security Alerts contain a <code>verdict</code> enumeration for each type of <code>evidence</code> associated with the Alert. This is typically set by an automated investigation process or an analyst/investigator assigned to the finding.",
"requirement": "optional",
"caption": "Verdict ID",
"type_name": "Integer",
"sibling": "verdict",
"_source": "evidences"
}
},
{
"reg_key": {
"type": "object_t",
"description": "Describes details about the registry key that triggered the detection.",
"group": "primary",
"extension": "win",
"requirement": "recommended",
"extension_id": 2,
"caption": "Registry Key",
"object_name": "Registry Key",
"object_type": "win/reg_key",
"_source": "win/evidences",
"_source_patched": "evidences"
}
},
{
"reg_value": {
"type": "object_t",
"description": "Describes details about the registry value that triggered the detection.",
"group": "primary",
"extension": "win",
"requirement": "recommended",
"extension_id": 2,
"caption": "Registry Value",
"object_name": "Registry Value",
"object_type": "win/reg_value",
"_source": "win/evidences",
"_source_patched": "evidences"
}
},
{
"win_service": {
"type": "object_t",
"description": "Describes details about the Windows service that triggered the detection.",
"extension": "win",
"requirement": "recommended",
"extension_id": 2,
"caption": "Windows Service",
"object_name": "Windows Service",
"object_type": "win/win_service",
"_source": "win/evidences",
"_source_patched": "evidences"
}
}
],
"name": "evidences",
"description": "A collection of evidence artifacts associated to the activity/activities that triggered a security detection.",
"extends": "_entity",
"constraints": {
"at_least_one": [
"actor",
"api",
"connection_info",
"data",
"database",
"databucket",
"device",
"dst_endpoint",
"email",
"file",
"process",
"query",
"src_endpoint",
"url",
"user",
"job",
"script",
"reg_key",
"reg_value",
"win_service"
]
},
"profiles": [
"data_classification",
"cloud",
"container",
"linux/linux_users"
],
"caption": "Evidence Artifacts"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/finding_info.json
Generated
-318
View File
@@ -1,318 +0,0 @@
{
"attributes": [
{
"title": {
"type": "string_t",
"description": "A title or a brief phrase summarizing the reported finding.",
"requirement": "recommended",
"caption": "Title",
"type_name": "String",
"_source": "finding_info"
}
},
{
"desc": {
"type": "string_t",
"description": "The description of the reported finding.",
"requirement": "optional",
"caption": "Description",
"type_name": "String",
"_source": "finding_info"
}
},
{
"product": {
"type": "object_t",
"description": "Details about the product that reported the finding.",
"requirement": "optional",
"caption": "Product",
"object_name": "Product",
"object_type": "product",
"_source": "finding_info"
}
},
{
"uid": {
"type": "string_t",
"description": "The unique identifier of the reported finding.",
"requirement": "required",
"caption": "Unique ID",
"type_name": "String",
"_source": "finding_info"
}
},
{
"types": {
"type": "string_t",
"description": "One or more types of the reported finding.",
"is_array": true,
"requirement": "optional",
"caption": "Types",
"type_name": "String",
"_source": "finding_info"
}
},
{
"tags": {
"type": "object_t",
"description": "The list of tags; <code>{key:value}</code> pairs associated with the finding.",
"is_array": true,
"requirement": "optional",
"caption": "Tags",
"object_name": "Key:Value object",
"object_type": "key_value_object",
"_source": "finding_info"
}
},
{
"attacks": {
"type": "object_t",
"description": "The <a target='_blank' href='https://attack.mitre.org'>MITRE ATT&CK\u00ae</a> technique and associated tactics related to the finding.",
"is_array": true,
"references": [
{
"description": "MITRE ATT&CK\u00ae",
"url": "https://attack.mitre.org"
},
{
"description": "MITRE ATLAS",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"requirement": "optional",
"caption": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details",
"object_name": "MITRE ATT&CK\u00ae & ATLAS\u2122",
"object_type": "attack",
"_source": "finding_info"
}
},
{
"analytic": {
"type": "object_t",
"description": "The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion.",
"requirement": "recommended",
"caption": "Analytic",
"object_name": "Analytic",
"object_type": "analytic",
"_source": "finding_info"
}
},
{
"attack_graph": {
"type": "object_t",
"description": "An Attack Graph describes possible routes an attacker could take through an environment. It describes relationships between resources and their findings, such as malware detections, vulnerabilities, misconfigurations, and other security actions.",
"group": "context",
"references": [
{
"description": "MS Defender description of Attack Path",
"url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path"
},
{
"description": "SentinelOne Attack Path documentation",
"url": "https://www.sentinelone.com/cybersecurity-101/cybersecurity/attack-path-analysis/"
}
],
"requirement": "optional",
"caption": "Attack Graph",
"object_name": "Graph",
"object_type": "graph",
"_source": "finding_info"
}
},
{
"created_time": {
"type": "timestamp_t",
"description": "The time when the finding was created.",
"requirement": "optional",
"caption": "Created Time",
"type_name": "Timestamp",
"_source": "finding_info"
}
},
{
"data_sources": {
"type": "string_t",
"description": "A list of data sources utilized in generation of the finding.",
"is_array": true,
"requirement": "optional",
"caption": "Data Sources",
"type_name": "String",
"_source": "finding_info"
}
},
{
"first_seen_time": {
"type": "timestamp_t",
"description": "The time when the finding was first observed. e.g. The time when a vulnerability was first observed. <p>It can differ from the <code>created_time</code> timestamp, which reflects the time this finding was created.</p>",
"requirement": "optional",
"caption": "First Seen",
"type_name": "Timestamp",
"_source": "finding_info"
}
},
{
"kill_chain": {
"type": "object_t",
"description": "The <a target='_blank' href='https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html'>Cyber Kill Chain\u00ae</a> provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.",
"is_array": true,
"requirement": "optional",
"caption": "Kill Chain",
"object_name": "Kill Chain Phase",
"object_type": "kill_chain_phase",
"_source": "finding_info"
}
},
{
"last_seen_time": {
"type": "timestamp_t",
"description": "The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed. <p>It can differ from the <code>modified_time</code> timestamp, which reflects the time this finding was last modified.</p>",
"requirement": "optional",
"caption": "Last Seen",
"type_name": "Timestamp",
"_source": "finding_info"
}
},
{
"modified_time": {
"type": "timestamp_t",
"description": "The time when the finding was last modified.",
"requirement": "optional",
"caption": "Modified Time",
"type_name": "Timestamp",
"_source": "finding_info"
}
},
{
"product_uid": {
"type": "string_t",
"description": "The unique identifier of the product that reported the finding.",
"requirement": "optional",
"caption": "Product Identifier",
"type_name": "String",
"@deprecated": {
"message": "Use the <code>uid</code> attribute in the <code>product</code> object instead. See specific usage.",
"since": "1.4.0"
},
"_source": "finding_info"
}
},
{
"related_analytics": {
"type": "object_t",
"description": "Other analytics related to this finding.",
"is_array": true,
"requirement": "optional",
"caption": "Related Analytics",
"object_name": "Analytic",
"object_type": "analytic",
"_source": "finding_info"
}
},
{
"related_events": {
"type": "object_t",
"description": "Describes events and/or other findings related to the finding as identified by the security product. Note that these events may or may not be in OCSF.",
"is_array": true,
"requirement": "optional",
"caption": "Related Events/Findings",
"object_name": "Related Event/Finding",
"object_type": "related_event",
"_source": "finding_info"
}
},
{
"related_events_count": {
"type": "integer_t",
"description": "Number of related events or findings.",
"requirement": "optional",
"caption": "Related Events/Findings Count",
"type_name": "Integer",
"_source": "finding_info"
}
},
{
"src_url": {
"type": "url_t",
"description": "The URL pointing to the source of the finding.",
"requirement": "optional",
"caption": "Source URL",
"type_name": "URL String",
"_source": "finding_info"
}
},
{
"traits": {
"type": "object_t",
"description": "The list of key traits or characteristics extracted from the finding.",
"is_array": true,
"requirement": "optional",
"caption": "Traits",
"object_name": "Trait",
"object_type": "trait",
"_source": "finding_info"
}
},
{
"uid_alt": {
"type": "string_t",
"description": "The alternative unique identifier of the reported finding.",
"requirement": "optional",
"caption": "Alternate ID",
"type_name": "String",
"_source": "finding_info"
}
},
{
"last_seen_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed. <p>It can differ from the <code>modified_time</code> timestamp, which reflects the time this finding was last modified.</p>",
"requirement": "optional",
"caption": "Last Seen",
"type_name": "Datetime",
"_source": "finding_info"
}
},
{
"modified_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the finding was last modified.",
"requirement": "optional",
"caption": "Modified Time",
"type_name": "Datetime",
"_source": "finding_info"
}
},
{
"first_seen_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the finding was first observed. e.g. The time when a vulnerability was first observed. <p>It can differ from the <code>created_time</code> timestamp, which reflects the time this finding was created.</p>",
"requirement": "optional",
"caption": "First Seen",
"type_name": "Datetime",
"_source": "finding_info"
}
},
{
"created_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the finding was created.",
"requirement": "optional",
"caption": "Created Time",
"type_name": "Datetime",
"_source": "finding_info"
}
}
],
"name": "finding_info",
"description": "The Finding Information object describes metadata related to a security finding generated by a security tool or system.",
"extends": "object",
"profiles": [
"data_classification",
"datetime"
],
"caption": "Finding Information"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/firewall_rule.json
Generated
-135
View File
@@ -1,135 +0,0 @@
{
"attributes": [
{
"name": {
"type": "string_t",
"description": "The name of the rule that generated the event.",
"requirement": "recommended",
"caption": "Name",
"type_name": "String",
"_source": "rule"
}
},
{
"type": {
"type": "string_t",
"description": "The rule type.",
"requirement": "optional",
"caption": "Type",
"type_name": "String",
"_source": "rule"
}
},
{
"version": {
"type": "string_t",
"description": "The rule version. For example: <code>1.1</code>.",
"requirement": "optional",
"caption": "Version",
"type_name": "String",
"_source": "rule"
}
},
{
"desc": {
"type": "string_t",
"description": "The description of the rule that generated the event.",
"requirement": "optional",
"caption": "Description",
"type_name": "String",
"_source": "rule"
}
},
{
"uid": {
"type": "string_t",
"description": "The unique identifier of the rule that generated the event.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String",
"_source": "rule"
}
},
{
"category": {
"type": "string_t",
"description": "The rule category.",
"requirement": "optional",
"caption": "Category",
"type_name": "String",
"_source": "rule"
}
},
{
"duration": {
"type": "long_t",
"description": "The rule response time duration, usually used for challenge completion time.",
"requirement": "optional",
"caption": "Duration Milliseconds",
"type_name": "Long",
"_source": "firewall_rule"
}
},
{
"condition": {
"type": "string_t",
"description": "The rule trigger condition for the rule. For example: SQL_INJECTION.",
"requirement": "optional",
"caption": "Condition",
"type_name": "String",
"_source": "firewall_rule"
}
},
{
"match_details": {
"type": "string_t",
"description": "The data in a request that rule matched. For example: '[\"10\",\"and\",\"1\"]'.",
"is_array": true,
"requirement": "optional",
"caption": "Match Details",
"type_name": "String",
"_source": "firewall_rule"
}
},
{
"match_location": {
"type": "string_t",
"description": "The location of the matched data in the source which resulted in the triggered firewall rule. For example: HEADER.",
"requirement": "optional",
"caption": "Match Location",
"type_name": "String",
"_source": "firewall_rule"
}
},
{
"rate_limit": {
"type": "integer_t",
"description": "The rate limit for a rate-based rule.",
"requirement": "optional",
"caption": "Rate Limit",
"type_name": "Integer",
"_source": "firewall_rule"
}
},
{
"sensitivity": {
"type": "string_t",
"description": "The sensitivity of the firewall rule in the matched event. For example: HIGH.",
"requirement": "optional",
"caption": "Sensitivity",
"type_name": "String",
"_source": "firewall_rule"
}
}
],
"name": "firewall_rule",
"description": "The Firewall Rule object represents a specific rule within a firewall policy or event. It contains information about a rule's configuration, properties, and associated actions that define how network traffic is handled by the firewall.",
"extends": "rule",
"constraints": {
"at_least_one": [
"name",
"uid"
]
},
"caption": "Firewall Rule"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/http_request.json
Generated
-167
View File
@@ -1,167 +0,0 @@
{
"attributes": [
{
"args": {
"type": "string_t",
"description": "The arguments sent along with the HTTP request.",
"requirement": "optional",
"caption": "HTTP Arguments",
"type_name": "String",
"_source": "http_request"
}
},
{
"version": {
"type": "string_t",
"description": "The Hypertext Transfer Protocol (HTTP) version.",
"requirement": "recommended",
"caption": "HTTP Version",
"type_name": "String",
"_source": "http_request"
}
},
{
"length": {
"type": "integer_t",
"description": "The length of the entire HTTP request, in number of bytes.",
"requirement": "optional",
"caption": "Request Length",
"type_name": "Integer",
"_source": "http_request"
}
},
{
"uid": {
"type": "string_t",
"description": "The unique identifier of the http request.",
"requirement": "optional",
"caption": "Unique ID",
"type_name": "String",
"_source": "http_request"
}
},
{
"url": {
"type": "object_t",
"description": "The URL object that pertains to the request.",
"requirement": "recommended",
"caption": "URL",
"object_name": "Uniform Resource Locator",
"object_type": "url",
"_source": "http_request"
}
},
{
"body_length": {
"type": "integer_t",
"description": "The actual length of the HTTP request body, in number of bytes, independent of a potentially existing Content-Length header.",
"requirement": "optional",
"caption": "Request Body Length",
"type_name": "Integer",
"_source": "http_request"
}
},
{
"user_agent": {
"type": "string_t",
"description": "The request header that identifies the operating system and web browser.",
"requirement": "recommended",
"caption": "HTTP User-Agent",
"type_name": "String",
"observable": 16,
"_source": "http_request"
}
},
{
"http_headers": {
"type": "object_t",
"description": "Additional HTTP headers of an HTTP request or response.",
"is_array": true,
"requirement": "recommended",
"caption": "HTTP Headers",
"object_name": "HTTP Header",
"object_type": "http_header",
"_source": "http_request"
}
},
{
"http_method": {
"type": "string_t",
"enum": {
"OPTIONS": {
"description": "The OPTIONS method describes the communication options for the target resource.",
"caption": "Options"
},
"GET": {
"description": "The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.",
"caption": "Get"
},
"HEAD": {
"description": "The HEAD method asks for a response identical to a GET request, but without the response body.",
"caption": "Head"
},
"POST": {
"description": "The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.",
"caption": "Post"
},
"PUT": {
"description": "The PUT method replaces all current representations of the target resource with the request payload.",
"caption": "Put"
},
"DELETE": {
"description": "The DELETE method deletes the specified resource.",
"caption": "Delete"
},
"TRACE": {
"description": "The TRACE method performs a message loop-back test along the path to the target resource.",
"caption": "Trace"
},
"CONNECT": {
"description": "The CONNECT method establishes a tunnel to the server identified by the target resource.",
"caption": "Connect"
},
"PATCH": {
"description": "The PATCH method applies partial modifications to a resource.",
"caption": "Patch"
}
},
"description": "The <a target='_blank' href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP request method</a> indicates the desired action to be performed for a given resource.",
"requirement": "recommended",
"caption": "HTTP Method",
"type_name": "String",
"_source": "http_request"
}
},
{
"referrer": {
"type": "string_t",
"description": "The request header that identifies the address of the previous web page, which is linked to the current web page or resource being requested.",
"requirement": "optional",
"caption": "HTTP Referrer",
"type_name": "String",
"_source": "http_request"
}
},
{
"x_forwarded_for": {
"type": "ip_t",
"description": "The X-Forwarded-For header identifying the originating IP address(es) of a client connecting to a web server through an HTTP proxy or a load balancer.",
"is_array": true,
"requirement": "optional",
"caption": "X-Forwarded-For",
"type_name": "IP Address",
"_source": "http_request"
}
}
],
"name": "http_request",
"description": "The HTTP Request object represents the attributes of a request made to a web server. It encapsulates the details and metadata associated with an HTTP request, including the request method, headers, URL, query parameters, body content, and other relevant information.",
"extends": "object",
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:OutboundInternetNetworkTraffic.",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:OutboundInternetNetworkTraffic/"
}
],
"caption": "HTTP Request"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/http_response.json
Generated
-96
View File
@@ -1,96 +0,0 @@
{
"attributes": [
{
"code": {
"type": "integer_t",
"description": "The Hypertext Transfer Protocol (HTTP) status code returned from the web server to the client. For example, 200.",
"requirement": "required",
"caption": "Response Code",
"type_name": "Integer",
"_source": "http_response"
}
},
{
"message": {
"type": "string_t",
"description": "The description of the event/finding, as defined by the source.",
"requirement": "optional",
"caption": "Message",
"type_name": "String",
"_source": "http_response"
}
},
{
"status": {
"type": "string_t",
"description": "The response status. For example: A successful HTTP status of 'OK' which corresponds to a code of 200.",
"requirement": "optional",
"caption": "Status",
"type_name": "String",
"_source": "http_response"
}
},
{
"length": {
"type": "integer_t",
"description": "The length of the entire HTTP response, in number of bytes.",
"requirement": "optional",
"caption": "Response Length",
"type_name": "Integer",
"_source": "http_response"
}
},
{
"content_type": {
"type": "string_t",
"description": "The request header that identifies the original <a target='_blank' href='https://www.iana.org/assignments/media-types/media-types.xhtml'>media type </a> of the resource (prior to any content encoding applied for sending).",
"requirement": "optional",
"caption": "HTTP Content Type",
"type_name": "String",
"_source": "http_response"
}
},
{
"body_length": {
"type": "integer_t",
"description": "The actual length of the HTTP response body, in number of bytes, independent of a potentially existing Content-Length header.",
"requirement": "optional",
"caption": "Response Body Length",
"type_name": "Integer",
"_source": "http_response"
}
},
{
"http_headers": {
"type": "object_t",
"description": "Additional HTTP headers of an HTTP request or response.",
"is_array": true,
"requirement": "recommended",
"caption": "HTTP Headers",
"object_name": "HTTP Header",
"object_type": "http_header",
"_source": "http_response"
}
},
{
"latency": {
"type": "integer_t",
"description": "The HTTP response latency measured in milliseconds.",
"requirement": "optional",
"caption": "Latency",
"type_name": "Integer",
"_source": "http_response"
}
}
],
"name": "http_response",
"description": "The HTTP Response object contains detailed information about the response sent from a web server to the requester. It encompasses attributes and metadata that describe the response status, headers, body content, and other relevant information.",
"extends": "object",
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:InboundInternetNetworkTraffic.",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:InboundInternetNetworkTraffic/"
}
],
"caption": "HTTP Response"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/metadata.json
Generated
-431
View File
@@ -1,431 +0,0 @@
{
"attributes": [
{
"untruncated_size": {
"type": "integer_t",
"description": "The original size of the OCSF event data in kilobytes before any truncation occurred. This field is typically populated when <code>is_truncated</code> is <code>true</code> to indicate the full size of the original event.",
"requirement": "optional",
"caption": "Untruncated Size",
"type_name": "Integer",
"_source": "metadata"
}
},
{
"profiles": {
"type": "string_t",
"description": "The list of profiles used to create the event. Profiles should be referenced by their <code>name</code> attribute for core profiles, or <code>extension/name</code> for profiles from extensions.",
"is_array": true,
"requirement": "optional",
"caption": "Profiles",
"type_name": "String",
"_source": "metadata"
}
},
{
"loggers": {
"type": "object_t",
"description": "An array of Logger objects that describe the pipeline of devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow and/or to track the chain of custody of the data.",
"is_array": true,
"requirement": "optional",
"caption": "Loggers",
"object_name": "Logger",
"object_type": "logger",
"_source": "metadata"
}
},
{
"type": {
"type": "string_t",
"description": "The type of the event or finding as a subset of the <code>source</code> of the event. This can be any distinguishing characteristic of the data. For example 'Management Events' or 'Device Penetration Test'.",
"requirement": "optional",
"caption": "Type",
"type_name": "String",
"_source": "metadata"
}
},
{
"processed_time": {
"type": "timestamp_t",
"description": "The event processed time, such as an ETL operation.",
"requirement": "optional",
"caption": "Processed Time",
"type_name": "Timestamp",
"_source": "metadata"
}
},
{
"is_truncated": {
"type": "boolean_t",
"description": "Indicates whether the OCSF event data has been truncated due to size limitations. When <code>true</code>, some event data may have been omitted to fit within system constraints.",
"requirement": "optional",
"caption": "Is Truncated",
"type_name": "Boolean",
"_source": "metadata"
}
},
{
"transformation_info_list": {
"type": "object_t",
"description": "An array of transformation info that describes the mappings or transforms applied to the data.",
"is_array": true,
"requirement": "optional",
"caption": "Transformation Info",
"object_name": "Transformation Info",
"object_type": "transformation_info",
"_source": "metadata"
}
},
{
"original_event_uid": {
"type": "string_t",
"description": "The unique identifier assigned to the event in its original logging system before transformation to OCSF format. This field preserves the source system's native event identifier, enabling traceability back to the raw log entry. For example, a Windows Event Record ID, a syslog message ID, a Splunk _cd value, or a database transaction log sequence number.",
"requirement": "optional",
"caption": "Original Event ID",
"type_name": "String",
"_source": "metadata"
}
},
{
"modified_time": {
"type": "timestamp_t",
"description": "The time when the event was last modified or enriched.",
"requirement": "optional",
"caption": "Modified Time",
"type_name": "Timestamp",
"_source": "metadata"
}
},
{
"data_classification": {
"profile": "data_classification",
"type": "object_t",
"description": "The Data Classification object includes information about data classification levels and data category types.",
"group": "context",
"requirement": "recommended",
"caption": "Data Classification",
"object_name": "Data Classification",
"object_type": "data_classification",
"@deprecated": {
"message": "Use the attribute <code>data_classifications</code> instead",
"since": "1.4.0"
},
"_source": "metadata"
}
},
{
"version": {
"type": "string_t",
"description": "The version of the OCSF schema, using Semantic Versioning Specification (<a target='_blank' href='https://semver.org'>SemVer</a>). For example: <code>1.0.0.</code> Event consumers use the version to determine the available event attributes.",
"requirement": "required",
"caption": "Version",
"type_name": "String",
"_source": "metadata"
}
},
{
"modified_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the event was last modified or enriched.",
"requirement": "optional",
"caption": "Modified Time",
"type_name": "Datetime",
"_source": "metadata"
}
},
{
"original_time": {
"type": "string_t",
"description": "The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.",
"requirement": "recommended",
"caption": "Original Time",
"type_name": "String",
"_source": "metadata"
}
},
{
"reporter": {
"type": "object_t",
"description": "The entity from which the event or finding was first reported.",
"requirement": "recommended",
"caption": "Reporter",
"object_name": "Reporter",
"object_type": "reporter",
"_source": "metadata"
}
},
{
"extension": {
"type": "object_t",
"description": "The schema extension used to create the event.",
"requirement": "optional",
"caption": "Schema Extension",
"object_name": "Schema Extension",
"object_type": "extension",
"@deprecated": {
"message": "Use the <code>extensions</code> attribute instead.",
"since": "1.1.0"
},
"_source": "metadata"
}
},
{
"logged_time": {
"type": "timestamp_t",
"description": "<p>The time when the logging system collected and logged the event.</p>This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.",
"requirement": "optional",
"caption": "Logged Time",
"type_name": "Timestamp",
"_source": "metadata"
}
},
{
"debug": {
"type": "string_t",
"description": "Debug information about non-fatal issues with this OCSF event. Each issue is a line in this string array.",
"is_array": true,
"requirement": "optional",
"caption": "Debug Information",
"type_name": "String",
"_source": "metadata"
}
},
{
"processed_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The event processed time, such as an ETL operation.",
"requirement": "optional",
"caption": "Processed Time",
"type_name": "Datetime",
"_source": "metadata"
}
},
{
"source": {
"type": "string_t",
"description": "The source of the event or finding. This can be any distinguishing name for the logical origin of the data \u2014 for example, 'CloudTrail Events', or a use case like 'Attack Simulations' or 'Vulnerability Scans'.",
"requirement": "optional",
"caption": "Source",
"type_name": "String",
"_source": "metadata"
}
},
{
"event_code": {
"type": "string_t",
"description": "The identifier of the original event. For example the numerical Windows Event Code or Cisco syslog code.",
"requirement": "optional",
"caption": "Event Code",
"type_name": "String",
"_source": "metadata"
}
},
{
"log_version": {
"type": "string_t",
"description": "The event log schema version of the original event. For example the syslog version or the Cisco Log Schema version",
"requirement": "optional",
"caption": "Log Version",
"type_name": "String",
"_source": "metadata"
}
},
{
"labels": {
"type": "string_t",
"description": "The list of labels attached to the event. For example: <code>[\"sample\", \"dev\"]</code>",
"is_array": true,
"requirement": "optional",
"caption": "Labels",
"type_name": "String",
"_source": "metadata"
}
},
{
"log_provider": {
"type": "string_t",
"description": "The logging provider or logging service that logged the event. For example AWS CloudWatch or Splunk.",
"requirement": "optional",
"caption": "Log Provider",
"type_name": "String",
"_source": "metadata"
}
},
{
"data_classifications": {
"profile": "data_classification",
"type": "object_t",
"description": "A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.",
"group": "context",
"is_array": true,
"requirement": "recommended",
"caption": "Data Classification",
"object_name": "Data Classification",
"object_type": "data_classification",
"_source": "metadata"
}
},
{
"log_source": {
"type": "string_t",
"description": "The log system or component where the data originated. For example, a file path, syslog server name or a Windows hostname and logging subsystem such as Security.",
"requirement": "optional",
"caption": "Log Source",
"type_name": "String",
"_source": "metadata"
}
},
{
"extensions": {
"type": "object_t",
"description": "The schema extensions used to create the event.",
"is_array": true,
"requirement": "optional",
"caption": "Schema Extensions",
"object_name": "Schema Extension",
"object_type": "extension",
"_source": "metadata"
}
},
{
"transmit_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the event was transmitted from the logging device to it's next destination.",
"requirement": "optional",
"caption": "Transmission Time",
"type_name": "Datetime",
"_source": "metadata"
}
},
{
"logged_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "<p>The time when the logging system collected and logged the event.</p>This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.",
"requirement": "optional",
"caption": "Logged Time",
"type_name": "Datetime",
"_source": "metadata"
}
},
{
"correlation_uid": {
"type": "string_t",
"description": "A unique identifier used to correlate this OCSF event with other related OCSF events, distinct from the event's <code>uid</code> value. This enables linking multiple OCSF events that are part of the same activity, transaction, or security incident across different systems or time periods.",
"requirement": "optional",
"caption": "Correlation UID",
"type_name": "String",
"_source": "metadata"
}
},
{
"uid": {
"type": "string_t",
"description": "A unique identifier assigned to the OCSF event. This ID is specific to the OCSF event itself and is distinct from the original event identifier in the source system (see <code>original_event_uid</code>).",
"requirement": "optional",
"caption": "Event UID",
"type_name": "String",
"_source": "metadata"
}
},
{
"tags": {
"type": "object_t",
"description": "The list of tags; <code>{key:value}</code> pairs associated to the event.",
"is_array": true,
"requirement": "optional",
"caption": "Tags",
"object_name": "Key:Value object",
"object_type": "key_value_object",
"_source": "metadata"
}
},
{
"log_level": {
"type": "string_t",
"description": "The level at which an event was logged. This can be log provider specific. For example the audit level.",
"requirement": "optional",
"caption": "Log Level",
"type_name": "String",
"_source": "metadata"
}
},
{
"transmit_time": {
"type": "timestamp_t",
"description": "The time when the event was transmitted from the logging device to it's next destination.",
"requirement": "optional",
"caption": "Transmission Time",
"type_name": "Timestamp",
"_source": "metadata"
}
},
{
"tenant_uid": {
"type": "string_t",
"description": "The unique tenant identifier.",
"requirement": "recommended",
"caption": "Tenant UID",
"type_name": "String",
"_source": "metadata"
}
},
{
"sequence": {
"type": "integer_t",
"description": "Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.",
"requirement": "optional",
"caption": "Sequence Number",
"type_name": "Integer",
"_source": "metadata"
}
},
{
"product": {
"type": "object_t",
"description": "The product that reported the event.",
"requirement": "required",
"caption": "Product",
"object_name": "Product",
"object_type": "product",
"_source": "metadata"
}
},
{
"log_name": {
"type": "string_t",
"description": "The event log name, typically for the consumer of the event. For example, the storage bucket name, SIEM repository index name, etc.",
"requirement": "recommended",
"caption": "Log Name",
"type_name": "String",
"_source": "metadata"
}
},
{
"log_format": {
"type": "string_t",
"description": "The format of data in the log where the data originated. For example CSV, XML, Windows Multiline, JSON, syslog or Cisco Log Schema.",
"requirement": "optional",
"caption": "Log Source Format",
"type_name": "String",
"_source": "metadata"
}
}
],
"name": "metadata",
"description": "The Metadata object describes the metadata associated with the event.",
"extends": "object",
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:Metadata",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:Metadata/"
}
],
"profiles": [
"data_classification",
"datetime"
],
"caption": "Metadata"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/network_endpoint.json
Generated
-448
View File
@@ -1,448 +0,0 @@
{
"attributes": [
{
"name": {
"type": "string_t",
"description": "The short name of the endpoint.",
"requirement": "recommended",
"caption": "Name",
"type_name": "String",
"_source": "endpoint"
}
},
{
"owner": {
"type": "object_t",
"description": "The identity of the service or user account that owns the endpoint or was last logged into it.",
"requirement": "recommended",
"caption": "Owner",
"object_name": "User",
"object_type": "user",
"_source": "endpoint"
}
},
{
"port": {
"type": "port_t",
"description": "The port used for communication within the network connection.",
"requirement": "recommended",
"caption": "Port",
"type_name": "Port",
"_source": "network_endpoint"
}
},
{
"type": {
"type": "string_t",
"description": "The network endpoint type. For example: <code>unknown</code>, <code>server</code>, <code>desktop</code>, <code>laptop</code>, <code>tablet</code>, <code>mobile</code>, <code>virtual</code>, <code>browser</code>, or <code>other</code>.",
"requirement": "optional",
"caption": "Type",
"type_name": "String",
"_source": "network_endpoint",
"_sibling_of": "type_id"
}
},
{
"os": {
"type": "object_t",
"description": "The endpoint operating system.",
"requirement": "optional",
"caption": "OS",
"object_name": "Operating System (OS)",
"object_type": "os",
"_source": "endpoint"
}
},
{
"domain": {
"type": "string_t",
"description": "The name of the domain that the endpoint belongs to or that corresponds to the endpoint.",
"requirement": "optional",
"caption": "Domain",
"type_name": "String",
"_source": "endpoint"
}
},
{
"ip": {
"type": "ip_t",
"description": "The IP address of the endpoint, in either IPv4 or IPv6 format.",
"requirement": "recommended",
"caption": "IP Address",
"type_name": "IP Address",
"_source": "endpoint"
}
},
{
"location": {
"type": "object_t",
"description": "The geographical location of the endpoint.",
"requirement": "optional",
"caption": "Geo Location",
"object_name": "Geo Location",
"object_type": "location",
"_source": "endpoint"
}
},
{
"hostname": {
"type": "hostname_t",
"description": "The fully qualified name of the endpoint.",
"requirement": "recommended",
"caption": "Hostname",
"type_name": "Hostname",
"_source": "endpoint"
}
},
{
"uid": {
"type": "string_t",
"description": "The unique identifier of the endpoint.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String",
"observable": 48,
"_source": "network_endpoint"
}
},
{
"mac": {
"type": "mac_t",
"description": "The Media Access Control (MAC) address of the endpoint.",
"requirement": "optional",
"caption": "MAC Address",
"type_name": "MAC Address",
"_source": "endpoint"
}
},
{
"type_id": {
"type": "integer_t",
"enum": {
"3": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/'>laptop computer</a>.",
"caption": "Laptop"
},
"6": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/'>virtual machine</a>.",
"caption": "Virtual"
},
"0": {
"description": "The type is unknown.",
"caption": "Unknown"
},
"1": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Server/'>server</a>.",
"caption": "Server"
},
"2": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/'>desktop computer</a>.",
"caption": "Desktop"
},
"99": {
"description": "The type is not mapped. See the <code>type</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/'>tablet computer</a>.",
"caption": "Tablet"
},
"5": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/'>mobile phone</a>.",
"caption": "Mobile"
},
"7": {
"description": "An <a target='_blank' href='https://www.techtarget.com/iotagenda/definition/IoT-device'>IOT (Internet of Things) device</a>.",
"caption": "IOT"
},
"8": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Browser/'>web browser</a>.",
"caption": "Browser"
},
"9": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Firewall/'>networking firewall</a>.",
"caption": "Firewall"
},
"10": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Switch/'>networking switch</a>.",
"caption": "Switch"
},
"11": {
"description": "A <a target='_blank' href='https://en.wikipedia.org/wiki/Ethernet_hub'>networking hub</a>.",
"caption": "Hub"
},
"12": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Router/'>networking router</a>.",
"caption": "Router"
},
"14": {
"description": "An <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/'>intrusion prevention system</a>.",
"caption": "IPS"
},
"15": {
"description": "A <a target='_blank' href='https://en.wikipedia.org/wiki/Load_balancing_(computing)'>Load Balancer device.</a>",
"caption": "Load Balancer"
},
"13": {
"description": "An <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/'>intrusion detection system</a>.",
"caption": "IDS"
}
},
"description": "The network endpoint type ID.",
"requirement": "recommended",
"caption": "Type ID",
"type_name": "Integer",
"sibling": "type",
"_source": "network_endpoint"
}
},
{
"agent_list": {
"type": "object_t",
"description": "A list of <code>agent</code> objects associated with a device, endpoint, or resource.",
"is_array": true,
"requirement": "optional",
"caption": "Agent List",
"object_name": "Agent",
"object_type": "agent",
"_source": "endpoint"
}
},
{
"autonomous_system": {
"type": "object_t",
"description": "The Autonomous System details associated with an IP address.",
"requirement": "optional",
"caption": "Autonomous System",
"object_name": "Autonomous System",
"object_type": "autonomous_system",
"_source": "network_endpoint"
}
},
{
"container": {
"profile": "container",
"type": "object_t",
"description": "The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.",
"group": "context",
"requirement": "recommended",
"caption": "Container",
"object_name": "Container",
"object_type": "container",
"_source": "endpoint"
}
},
{
"hw_info": {
"type": "object_t",
"description": "The endpoint hardware information.",
"requirement": "optional",
"caption": "Hardware Info",
"object_name": "Device Hardware Info",
"object_type": "device_hw_info",
"_source": "endpoint"
}
},
{
"instance_uid": {
"type": "string_t",
"description": "The unique identifier of a VM instance.",
"requirement": "recommended",
"caption": "Instance ID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"interface_name": {
"type": "string_t",
"description": "The name of the network interface (e.g. eth2).",
"requirement": "recommended",
"caption": "Network Interface Name",
"type_name": "String",
"_source": "endpoint"
}
},
{
"interface_uid": {
"type": "string_t",
"description": "The unique identifier of the network interface.",
"requirement": "recommended",
"caption": "Network Interface ID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"intermediate_ips": {
"type": "ip_t",
"description": "The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header.",
"is_array": true,
"requirement": "optional",
"caption": "Intermediate IP Addresses",
"type_name": "IP Address",
"_source": "network_endpoint"
}
},
{
"isp": {
"type": "string_t",
"description": "The name of the Internet Service Provider (ISP).",
"requirement": "optional",
"caption": "ISP Name",
"type_name": "String",
"_source": "network_endpoint"
}
},
{
"isp_org": {
"type": "string_t",
"description": "The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names.",
"requirement": "optional",
"caption": "ISP Org",
"type_name": "String",
"_source": "network_endpoint"
}
},
{
"namespace_pid": {
"profile": "container",
"type": "integer_t",
"description": "If running under a process namespace (such as in a container), the process identifier within that process namespace.",
"group": "context",
"requirement": "recommended",
"caption": "Namespace PID",
"type_name": "Integer",
"_source": "endpoint"
}
},
{
"network_scope": {
"type": "string_t",
"description": "Indicates whether the endpoint resides inside the customer\u2019s network, outside on the Internet, or if its location relative to the customer\u2019s network cannot be determined. The value is normalized to the caption of the <code>network_scope_id</code>.",
"requirement": "optional",
"caption": "Network Scope",
"type_name": "String",
"_source": "network_endpoint",
"_sibling_of": "network_scope_id"
}
},
{
"network_scope_id": {
"type": "integer_t",
"enum": {
"0": {
"description": "Unknown whether this endpoint resides within the customer\u2019s network.",
"caption": "Unknown"
},
"1": {
"description": "The endpoint resides inside the customer\u2019s network.",
"caption": "Internal"
},
"2": {
"description": "The endpoint is on the Internet or otherwise external to the customer\u2019s network.",
"caption": "External"
},
"99": {
"description": "The network scope is not mapped. See the <code>network_scope</code> attribute, which contains a data source specific value.",
"caption": "Other"
}
},
"description": "The normalized identifier of the endpoint\u2019s network scope. The normalized network scope identifier indicates whether the endpoint resides inside the customer\u2019s network, outside on the Internet, or if its location relative to the customer\u2019s network cannot be determined.",
"requirement": "optional",
"caption": "Network Scope ID",
"type_name": "Integer",
"sibling": "network_scope",
"_source": "network_endpoint"
}
},
{
"proxy_endpoint": {
"type": "object_t",
"description": "The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT).",
"requirement": "optional",
"caption": "Proxy Endpoint",
"object_name": "Network Proxy Endpoint",
"object_type": "network_proxy",
"_source": "network_endpoint"
}
},
{
"subnet_uid": {
"type": "string_t",
"description": "The unique identifier of a virtual subnet.",
"requirement": "optional",
"caption": "Subnet UID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"svc_name": {
"type": "string_t",
"description": "The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service.",
"requirement": "recommended",
"caption": "Service Name",
"type_name": "String",
"_source": "network_endpoint"
}
},
{
"vlan_uid": {
"type": "string_t",
"description": "The Virtual LAN identifier.",
"requirement": "optional",
"caption": "VLAN",
"type_name": "String",
"_source": "endpoint"
}
},
{
"vpc_uid": {
"type": "string_t",
"description": "The unique identifier of the Virtual Private Cloud (VPC).",
"requirement": "optional",
"caption": "VPC UID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"zone": {
"type": "string_t",
"description": "The network zone or LAN segment.",
"requirement": "optional",
"caption": "Network Zone",
"type_name": "String",
"_source": "endpoint"
}
}
],
"name": "network_endpoint",
"description": "The Network Endpoint object describes characteristics of a network endpoint. These can be a source or destination of a network connection.",
"extends": "endpoint",
"constraints": {
"at_least_one": [
"ip",
"uid",
"name",
"hostname",
"svc_name",
"instance_uid",
"interface_uid",
"interface_name",
"domain"
]
},
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:ComputerNetworkNode.",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:ComputerNetworkNode/"
}
],
"profiles": [
"container"
],
"caption": "Network Endpoint",
"observable": 20
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/network_proxy.json
Generated
-448
View File
@@ -1,448 +0,0 @@
{
"attributes": [
{
"name": {
"type": "string_t",
"description": "The short name of the endpoint.",
"requirement": "recommended",
"caption": "Name",
"type_name": "String",
"_source": "endpoint"
}
},
{
"owner": {
"type": "object_t",
"description": "The identity of the service or user account that owns the endpoint or was last logged into it.",
"requirement": "recommended",
"caption": "Owner",
"object_name": "User",
"object_type": "user",
"_source": "endpoint"
}
},
{
"port": {
"type": "port_t",
"description": "The port used for communication within the network connection.",
"requirement": "recommended",
"caption": "Port",
"type_name": "Port",
"_source": "network_endpoint"
}
},
{
"type": {
"type": "string_t",
"description": "The network endpoint type. For example: <code>unknown</code>, <code>server</code>, <code>desktop</code>, <code>laptop</code>, <code>tablet</code>, <code>mobile</code>, <code>virtual</code>, <code>browser</code>, or <code>other</code>.",
"requirement": "optional",
"caption": "Type",
"type_name": "String",
"_source": "network_endpoint",
"_sibling_of": "type_id"
}
},
{
"os": {
"type": "object_t",
"description": "The endpoint operating system.",
"requirement": "optional",
"caption": "OS",
"object_name": "Operating System (OS)",
"object_type": "os",
"_source": "endpoint"
}
},
{
"domain": {
"type": "string_t",
"description": "The name of the domain that the endpoint belongs to or that corresponds to the endpoint.",
"requirement": "optional",
"caption": "Domain",
"type_name": "String",
"_source": "endpoint"
}
},
{
"ip": {
"type": "ip_t",
"description": "The IP address of the endpoint, in either IPv4 or IPv6 format.",
"requirement": "recommended",
"caption": "IP Address",
"type_name": "IP Address",
"_source": "endpoint"
}
},
{
"location": {
"type": "object_t",
"description": "The geographical location of the endpoint.",
"requirement": "optional",
"caption": "Geo Location",
"object_name": "Geo Location",
"object_type": "location",
"_source": "endpoint"
}
},
{
"hostname": {
"type": "hostname_t",
"description": "The fully qualified name of the endpoint.",
"requirement": "recommended",
"caption": "Hostname",
"type_name": "Hostname",
"_source": "endpoint"
}
},
{
"uid": {
"type": "string_t",
"description": "The unique identifier of the endpoint.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String",
"observable": 48,
"_source": "network_endpoint"
}
},
{
"mac": {
"type": "mac_t",
"description": "The Media Access Control (MAC) address of the endpoint.",
"requirement": "optional",
"caption": "MAC Address",
"type_name": "MAC Address",
"_source": "endpoint"
}
},
{
"type_id": {
"type": "integer_t",
"enum": {
"3": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/'>laptop computer</a>.",
"caption": "Laptop"
},
"6": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/'>virtual machine</a>.",
"caption": "Virtual"
},
"0": {
"description": "The type is unknown.",
"caption": "Unknown"
},
"1": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Server/'>server</a>.",
"caption": "Server"
},
"2": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/'>desktop computer</a>.",
"caption": "Desktop"
},
"99": {
"description": "The type is not mapped. See the <code>type</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/'>tablet computer</a>.",
"caption": "Tablet"
},
"5": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/'>mobile phone</a>.",
"caption": "Mobile"
},
"7": {
"description": "An <a target='_blank' href='https://www.techtarget.com/iotagenda/definition/IoT-device'>IOT (Internet of Things) device</a>.",
"caption": "IOT"
},
"8": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Browser/'>web browser</a>.",
"caption": "Browser"
},
"9": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Firewall/'>networking firewall</a>.",
"caption": "Firewall"
},
"10": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Switch/'>networking switch</a>.",
"caption": "Switch"
},
"11": {
"description": "A <a target='_blank' href='https://en.wikipedia.org/wiki/Ethernet_hub'>networking hub</a>.",
"caption": "Hub"
},
"12": {
"description": "A <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Router/'>networking router</a>.",
"caption": "Router"
},
"14": {
"description": "An <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/'>intrusion prevention system</a>.",
"caption": "IPS"
},
"15": {
"description": "A <a target='_blank' href='https://en.wikipedia.org/wiki/Load_balancing_(computing)'>Load Balancer device.</a>",
"caption": "Load Balancer"
},
"13": {
"description": "An <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/'>intrusion detection system</a>.",
"caption": "IDS"
}
},
"description": "The network endpoint type ID.",
"requirement": "recommended",
"caption": "Type ID",
"type_name": "Integer",
"sibling": "type",
"_source": "network_endpoint"
}
},
{
"agent_list": {
"type": "object_t",
"description": "A list of <code>agent</code> objects associated with a device, endpoint, or resource.",
"is_array": true,
"requirement": "optional",
"caption": "Agent List",
"object_name": "Agent",
"object_type": "agent",
"_source": "endpoint"
}
},
{
"autonomous_system": {
"type": "object_t",
"description": "The Autonomous System details associated with an IP address.",
"requirement": "optional",
"caption": "Autonomous System",
"object_name": "Autonomous System",
"object_type": "autonomous_system",
"_source": "network_endpoint"
}
},
{
"container": {
"profile": "container",
"type": "object_t",
"description": "The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.",
"group": "context",
"requirement": "recommended",
"caption": "Container",
"object_name": "Container",
"object_type": "container",
"_source": "endpoint"
}
},
{
"hw_info": {
"type": "object_t",
"description": "The endpoint hardware information.",
"requirement": "optional",
"caption": "Hardware Info",
"object_name": "Device Hardware Info",
"object_type": "device_hw_info",
"_source": "endpoint"
}
},
{
"instance_uid": {
"type": "string_t",
"description": "The unique identifier of a VM instance.",
"requirement": "recommended",
"caption": "Instance ID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"interface_name": {
"type": "string_t",
"description": "The name of the network interface (e.g. eth2).",
"requirement": "recommended",
"caption": "Network Interface Name",
"type_name": "String",
"_source": "endpoint"
}
},
{
"interface_uid": {
"type": "string_t",
"description": "The unique identifier of the network interface.",
"requirement": "recommended",
"caption": "Network Interface ID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"intermediate_ips": {
"type": "ip_t",
"description": "The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header.",
"is_array": true,
"requirement": "optional",
"caption": "Intermediate IP Addresses",
"type_name": "IP Address",
"_source": "network_endpoint"
}
},
{
"isp": {
"type": "string_t",
"description": "The name of the Internet Service Provider (ISP).",
"requirement": "optional",
"caption": "ISP Name",
"type_name": "String",
"_source": "network_endpoint"
}
},
{
"isp_org": {
"type": "string_t",
"description": "The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names.",
"requirement": "optional",
"caption": "ISP Org",
"type_name": "String",
"_source": "network_endpoint"
}
},
{
"namespace_pid": {
"profile": "container",
"type": "integer_t",
"description": "If running under a process namespace (such as in a container), the process identifier within that process namespace.",
"group": "context",
"requirement": "recommended",
"caption": "Namespace PID",
"type_name": "Integer",
"_source": "endpoint"
}
},
{
"network_scope": {
"type": "string_t",
"description": "Indicates whether the endpoint resides inside the customer\u2019s network, outside on the Internet, or if its location relative to the customer\u2019s network cannot be determined. The value is normalized to the caption of the <code>network_scope_id</code>.",
"requirement": "optional",
"caption": "Network Scope",
"type_name": "String",
"_source": "network_endpoint",
"_sibling_of": "network_scope_id"
}
},
{
"network_scope_id": {
"type": "integer_t",
"enum": {
"0": {
"description": "Unknown whether this endpoint resides within the customer\u2019s network.",
"caption": "Unknown"
},
"1": {
"description": "The endpoint resides inside the customer\u2019s network.",
"caption": "Internal"
},
"2": {
"description": "The endpoint is on the Internet or otherwise external to the customer\u2019s network.",
"caption": "External"
},
"99": {
"description": "The network scope is not mapped. See the <code>network_scope</code> attribute, which contains a data source specific value.",
"caption": "Other"
}
},
"description": "The normalized identifier of the endpoint\u2019s network scope. The normalized network scope identifier indicates whether the endpoint resides inside the customer\u2019s network, outside on the Internet, or if its location relative to the customer\u2019s network cannot be determined.",
"requirement": "optional",
"caption": "Network Scope ID",
"type_name": "Integer",
"sibling": "network_scope",
"_source": "network_endpoint"
}
},
{
"proxy_endpoint": {
"type": "object_t",
"description": "The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT).",
"requirement": "optional",
"caption": "Proxy Endpoint",
"object_name": "Network Proxy Endpoint",
"object_type": "network_proxy",
"_source": "network_endpoint"
}
},
{
"subnet_uid": {
"type": "string_t",
"description": "The unique identifier of a virtual subnet.",
"requirement": "optional",
"caption": "Subnet UID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"svc_name": {
"type": "string_t",
"description": "The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service.",
"requirement": "recommended",
"caption": "Service Name",
"type_name": "String",
"_source": "network_endpoint"
}
},
{
"vlan_uid": {
"type": "string_t",
"description": "The Virtual LAN identifier.",
"requirement": "optional",
"caption": "VLAN",
"type_name": "String",
"_source": "endpoint"
}
},
{
"vpc_uid": {
"type": "string_t",
"description": "The unique identifier of the Virtual Private Cloud (VPC).",
"requirement": "optional",
"caption": "VPC UID",
"type_name": "String",
"_source": "endpoint"
}
},
{
"zone": {
"type": "string_t",
"description": "The network zone or LAN segment.",
"requirement": "optional",
"caption": "Network Zone",
"type_name": "String",
"_source": "endpoint"
}
}
],
"name": "network_proxy",
"description": "The network proxy endpoint object describes a proxy server, which acts as an intermediary between a client requesting a resource and the server providing that resource.",
"extends": "network_endpoint",
"constraints": {
"at_least_one": [
"ip",
"uid",
"name",
"hostname",
"svc_name",
"instance_uid",
"interface_uid",
"interface_name",
"domain"
]
},
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:ProxyServer",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/"
}
],
"profiles": [
"container"
],
"caption": "Network Proxy Endpoint",
"observable": 20
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/process.json
Generated
-446
View File
@@ -1,446 +0,0 @@
{
"attributes": [
{
"name": {
"type": "process_name_t",
"description": "The friendly name of the process, for example: <code>Notepad++</code>.",
"requirement": "recommended",
"caption": "Name",
"type_name": "String",
"_source": "process_entity"
}
},
{
"pid": {
"type": "integer_t",
"description": "The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process.",
"requirement": "recommended",
"caption": "Process ID",
"type_name": "Integer",
"observable": 15,
"_source": "process_entity"
}
},
{
"session": {
"type": "object_t",
"description": "The user session under which this process is running.",
"requirement": "optional",
"caption": "Session",
"object_name": "Session",
"object_type": "session",
"_source": "process"
}
},
{
"file": {
"type": "object_t",
"description": "The process file object.",
"requirement": "recommended",
"caption": "File",
"object_name": "File",
"object_type": "file",
"_source": "process"
}
},
{
"user": {
"type": "object_t",
"description": "The user under which this process is running.",
"requirement": "recommended",
"caption": "User",
"object_name": "User",
"object_type": "user",
"_source": "process"
}
},
{
"path": {
"type": "string_t",
"description": "The process file path.",
"requirement": "optional",
"caption": "Path",
"type_name": "String",
"_source": "process_entity"
}
},
{
"group": {
"profile": "linux/linux_users",
"type": "object_t",
"description": "The group under which this process is running.",
"requirement": "recommended",
"caption": "Group",
"object_name": "Group",
"object_type": "group",
"_source": "linux/process",
"_source_patched": "process"
}
},
{
"tid": {
"type": "integer_t",
"description": "The identifier of the thread associated with the event, as returned by the operating system.",
"requirement": "optional",
"caption": "Thread ID",
"type_name": "Integer",
"@deprecated": {
"message": "<code>tid</code> is deprecated in favor of <code>ptid</code>. <code>ptid</code> has type <code>long_t</code> which can accommodate the thread identifiers returned by all platforms (e.g. 64-bit on MacOS).",
"since": "1.6.0"
},
"_source": "process"
}
},
{
"uid": {
"type": "string_t",
"description": "A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String",
"observable": 39,
"_source": "process_entity"
}
},
{
"loaded_modules": {
"type": "string_t",
"description": "The list of loaded module names.",
"is_array": true,
"requirement": "optional",
"caption": "Loaded Modules",
"type_name": "String",
"_source": "process"
}
},
{
"ancestry": {
"type": "object_t",
"description": "An array of Process Entities describing the extended parentage of this process object. Direct parent information should be expressed through the <code>parent_process</code> attribute. The first array element is the direct parent of this process object. Subsequent list elements go up the process parentage hierarchy. That is, the array is sorted from newest to oldest process. It is recommended to only populate this field for the top-level process object.",
"is_array": true,
"references": [
{
"description": "Guidance on Representing Process Parentage",
"url": "https://github.com/ocsf/ocsf-docs/blob/main/articles/representing-process-parentage.md"
}
],
"requirement": "optional",
"caption": "Ancestry",
"object_name": "Process Entity",
"object_type": "process_entity",
"_source": "process"
}
},
{
"cmd_line": {
"type": "string_t",
"description": "The full command line used to launch an application, service, process, or job. For example: <code>ssh user@10.0.0.10</code>. If the command line is unavailable or missing, the empty string <code>''</code> is to be used.",
"requirement": "recommended",
"caption": "Command Line",
"type_name": "String",
"observable": 13,
"_source": "process_entity"
}
},
{
"container": {
"profile": "container",
"type": "object_t",
"description": "The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.",
"group": "context",
"requirement": "recommended",
"caption": "Container",
"object_name": "Container",
"object_type": "container",
"_source": "process"
}
},
{
"cpid": {
"type": "uuid_t",
"description": "A unique process identifier that can be assigned deterministically by multiple system data producers.",
"source": "cpid",
"references": [
{
"description": "OCSF Common Process Identifier (CPID) Specification",
"url": "https://github.com/ocsf/common-process-id"
}
],
"requirement": "recommended",
"caption": "Common Process Identifier",
"type_name": "UUID",
"_source": "process_entity"
}
},
{
"created_time": {
"type": "timestamp_t",
"description": "The time when the process was created/started.",
"requirement": "recommended",
"caption": "Created Time",
"type_name": "Timestamp",
"_source": "process_entity"
}
},
{
"environment_variables": {
"type": "object_t",
"description": "Environment variables associated with the process.",
"is_array": true,
"requirement": "optional",
"caption": "Environment Variables",
"object_name": "Environment Variable",
"object_type": "environment_variable",
"_source": "process"
}
},
{
"integrity": {
"type": "string_t",
"description": "The process integrity level, normalized to the caption of the integrity_id value. In the case of 'Other', it is defined by the event source (Windows only).",
"requirement": "optional",
"caption": "Integrity",
"type_name": "String",
"_source": "process",
"_sibling_of": "integrity_id"
}
},
{
"integrity_id": {
"type": "integer_t",
"enum": {
"3": {
"caption": "Medium"
},
"6": {
"caption": "Protected"
},
"0": {
"description": "The integrity level is unknown.",
"caption": "Unknown"
},
"1": {
"caption": "Untrusted"
},
"2": {
"caption": "Low"
},
"99": {
"description": "The integrity level is not mapped. See the <code>integrity</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"caption": "High"
},
"5": {
"caption": "System"
}
},
"description": "The normalized identifier of the process integrity level (Windows only).",
"requirement": "optional",
"caption": "Integrity Level",
"type_name": "Integer",
"sibling": "integrity",
"_source": "process"
}
},
{
"lineage": {
"type": "file_path_t",
"description": "The lineage of the process, represented by a list of paths for each ancestor process. For example: <code>['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']</code>.",
"is_array": true,
"requirement": "optional",
"caption": "Lineage",
"type_name": "File Path",
"@deprecated": {
"message": "Use the <code>ancestry</code> attribute.",
"since": "1.4.0"
},
"_source": "process"
}
},
{
"namespace_pid": {
"profile": "container",
"type": "integer_t",
"description": "If running under a process namespace (such as in a container), the process identifier within that process namespace.",
"group": "context",
"requirement": "recommended",
"caption": "Namespace PID",
"type_name": "Integer",
"_source": "process"
}
},
{
"parent_process": {
"type": "object_t",
"description": "The parent process of this process object. It is recommended to only populate this field for the top-level process object, to prevent deep nesting. Additional ancestry information can be supplied in the <code>ancestry</code> attribute.",
"references": [
{
"description": "Guidance on Representing Process Parentage",
"url": "https://github.com/ocsf/ocsf-docs/blob/main/articles/representing-process-parentage.md"
}
],
"requirement": "recommended",
"caption": "Parent Process",
"object_name": "Process",
"object_type": "process",
"_source": "process"
}
},
{
"ptid": {
"type": "long_t",
"description": "The identifier of the process thread associated with the event, as returned by the operating system.",
"requirement": "optional",
"caption": "Process Thread ID",
"type_name": "Long",
"_source": "process"
}
},
{
"sandbox": {
"type": "string_t",
"description": "The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.",
"requirement": "optional",
"caption": "Sandbox",
"type_name": "String",
"_source": "process"
}
},
{
"terminated_time": {
"type": "timestamp_t",
"description": "The time when the process was terminated.",
"requirement": "optional",
"caption": "Terminated Time",
"type_name": "Timestamp",
"_source": "process"
}
},
{
"working_directory": {
"type": "string_t",
"description": "The working directory of a process.",
"requirement": "optional",
"caption": "Working Directory",
"type_name": "String",
"_source": "process"
}
},
{
"xattributes": {
"type": "object_t",
"description": "An unordered collection of zero or more name/value pairs that represent a process extended attribute.",
"requirement": "optional",
"caption": "Extended Attributes",
"object_name": "Object",
"object_type": "object",
"_source": "process"
}
},
{
"auid": {
"profile": "linux/linux_users",
"type": "integer_t",
"description": "The audit user assigned at login by the audit subsystem.",
"extension": "linux",
"requirement": "optional",
"extension_id": 1,
"caption": "Audit User ID",
"type_name": "Integer",
"_source": "linux/process",
"_source_patched": "process"
}
},
{
"egid": {
"profile": "linux/linux_users",
"type": "integer_t",
"description": "The effective group under which this process is running.",
"extension": "linux",
"requirement": "optional",
"extension_id": 1,
"caption": "Effective Group ID",
"type_name": "Integer",
"_source": "linux/process",
"_source_patched": "process"
}
},
{
"euid": {
"profile": "linux/linux_users",
"type": "integer_t",
"description": "The effective user under which this process is running.",
"extension": "linux",
"requirement": "optional",
"extension_id": 1,
"caption": "Effective User ID",
"type_name": "Integer",
"_source": "linux/process",
"_source_patched": "process"
}
},
{
"hosted_services": {
"type": "object_t",
"description": "The Windows services that this process is hosting.",
"extension": "win",
"is_array": true,
"requirement": "optional",
"extension_id": 2,
"caption": "Hosted Services",
"object_name": "Windows Service",
"object_type": "win/win_service",
"_source": "win/process",
"_source_patched": "process"
}
},
{
"terminated_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the process was terminated.",
"requirement": "optional",
"caption": "Terminated Time",
"type_name": "Datetime",
"_source": "process"
}
},
{
"created_time_dt": {
"profile": "datetime",
"type": "datetime_t",
"description": "The time when the process was created/started.",
"requirement": "optional",
"caption": "Created Time",
"type_name": "Datetime",
"_source": "process_entity"
}
}
],
"name": "process",
"description": "The Process object describes a running instance of a launched program.",
"extends": "process_entity",
"constraints": {
"at_least_one": [
"pid",
"uid",
"cpid"
]
},
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:Process",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:Process/"
}
],
"profiles": [
"container",
"linux/linux_users",
"data_classification",
"datetime"
],
"caption": "Process",
"observable": 25
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/product.json
Generated
-139
View File
@@ -1,139 +0,0 @@
{
"attributes": [
{
"name": {
"type": "string_t",
"description": "The name of the product.",
"requirement": "recommended",
"caption": "Name",
"type_name": "String",
"_source": "product"
}
},
{
"version": {
"type": "string_t",
"description": "The version of the product, as defined by the event source. For example: <code>2013.1.3-beta</code>.",
"requirement": "recommended",
"caption": "Version",
"type_name": "String",
"_source": "product"
}
},
{
"path": {
"type": "string_t",
"description": "The installation path of the product.",
"requirement": "optional",
"caption": "Path",
"type_name": "String",
"_source": "product"
}
},
{
"uid": {
"type": "string_t",
"description": "The unique identifier of the product.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String",
"_source": "product"
}
},
{
"feature": {
"type": "object_t",
"description": "The feature that reported the event.",
"requirement": "optional",
"caption": "Feature",
"object_name": "Feature",
"object_type": "feature",
"_source": "product"
}
},
{
"lang": {
"type": "string_t",
"description": "The two letter lower case language codes, as defined by <a target='_blank' href='https://en.wikipedia.org/wiki/ISO_639-1'>ISO 639-1</a>. For example: <code>en</code> (English), <code>de</code> (German), or <code>fr</code> (French).",
"requirement": "optional",
"caption": "Language",
"type_name": "String",
"_source": "product"
}
},
{
"cpe_name": {
"type": "string_t",
"description": "The Common Platform Enumeration (CPE) name as described by (<a target='_blank' href='https://nvd.nist.gov/products/cpe'>NIST</a>) For example: <code>cpe:/a:apple:safari:16.2</code>.",
"requirement": "optional",
"caption": "The product CPE identifier",
"type_name": "String",
"_source": "product"
}
},
{
"data_classification": {
"profile": "data_classification",
"type": "object_t",
"description": "The Data Classification object includes information about data classification levels and data category types.",
"group": "context",
"requirement": "recommended",
"caption": "Data Classification",
"object_name": "Data Classification",
"object_type": "data_classification",
"@deprecated": {
"message": "Use the attribute <code>data_classifications</code> instead",
"since": "1.4.0"
},
"_source": "product"
}
},
{
"data_classifications": {
"profile": "data_classification",
"type": "object_t",
"description": "A list of Data Classification objects, that include information about data classification levels and data category types, identified by a classifier.",
"group": "context",
"is_array": true,
"requirement": "recommended",
"caption": "Data Classification",
"object_name": "Data Classification",
"object_type": "data_classification",
"_source": "product"
}
},
{
"url_string": {
"type": "url_t",
"description": "The URL pointing towards the product.",
"requirement": "optional",
"caption": "URL String",
"type_name": "URL String",
"_source": "product"
}
},
{
"vendor_name": {
"type": "string_t",
"description": "The name of the vendor of the product.",
"requirement": "recommended",
"caption": "Vendor Name",
"type_name": "String",
"_source": "product"
}
}
],
"name": "product",
"description": "The Product object describes characteristics of a software product.",
"extends": "_entity",
"constraints": {
"at_least_one": [
"name",
"uid"
]
},
"profiles": [
"data_classification"
],
"caption": "Product"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/remediation.json
Generated
-74
View File
@@ -1,74 +0,0 @@
{
"attributes": [
{
"desc": {
"type": "string_t",
"description": "The description of the remediation strategy.",
"requirement": "required",
"caption": "Description",
"type_name": "String",
"_source": "remediation"
}
},
{
"references": {
"type": "string_t",
"description": "A list of supporting URL/s, references that help describe the remediation strategy.",
"is_array": true,
"requirement": "optional",
"caption": "References",
"type_name": "String",
"_source": "remediation"
}
},
{
"cis_controls": {
"type": "object_t",
"description": "An array of Center for Internet Security (CIS) Controls that can be optionally mapped to provide additional remediation details.",
"is_array": true,
"references": [
{
"description": "Center For Internet Security Controls",
"url": "https://www.cisecurity.org/controls/"
}
],
"requirement": "optional",
"caption": "CIS Controls",
"object_name": "CIS Control",
"object_type": "cis_control",
"_source": "remediation"
}
},
{
"kb_article_list": {
"type": "object_t",
"description": "A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update.",
"is_array": true,
"requirement": "optional",
"caption": "Knowledgebase Articles",
"object_name": "KB Article",
"object_type": "kb_article",
"_source": "remediation"
}
},
{
"kb_articles": {
"type": "string_t",
"description": "The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update.",
"is_array": true,
"requirement": "optional",
"caption": "Knowledgebase Articles",
"type_name": "String",
"@deprecated": {
"message": "Use the <code>kb_article_list</code> attribute instead.",
"since": "1.1.0"
},
"_source": "remediation"
}
}
],
"name": "remediation",
"description": "The Remediation object describes the recommended remediation steps to address identified issue(s).",
"extends": "object",
"caption": "Remediation"
}
crates/openshell-ocsf/schemas/ocsf/v1.7.0/objects/url.json
Generated
-404
View File
@@ -1,404 +0,0 @@
{
"attributes": [
{
"port": {
"type": "port_t",
"description": "The URL port. For example: <code>80</code>.",
"requirement": "recommended",
"caption": "Port",
"type_name": "Port",
"_source": "url"
}
},
{
"scheme": {
"type": "string_t",
"description": "The scheme portion of the URL. For example: <code>http</code>, <code>https</code>, <code>ftp</code>, or <code>sftp</code>.",
"requirement": "recommended",
"caption": "Scheme",
"type_name": "String",
"_source": "url"
}
},
{
"path": {
"type": "string_t",
"description": "The URL path as extracted from the URL. For example: <code>/download/trouble</code> from <code>www.example.com/download/trouble</code>.",
"requirement": "recommended",
"caption": "Path",
"type_name": "String",
"_source": "url"
}
},
{
"domain": {
"type": "string_t",
"description": "The domain portion of the URL. For example: <code>example.com</code> in <code>https://sub.example.com</code>.",
"requirement": "optional",
"caption": "Domain",
"type_name": "String",
"_source": "url"
}
},
{
"hostname": {
"type": "hostname_t",
"description": "The URL host as extracted from the URL. For example: <code>www.example.com</code> from <code>www.example.com/download/trouble</code>.",
"requirement": "recommended",
"caption": "Hostname",
"type_name": "Hostname",
"_source": "url"
}
},
{
"query_string": {
"type": "string_t",
"description": "The query portion of the URL. For example: the query portion of the URL <code>http://www.example.com/search?q=bad&sort=date</code> is <code>q=bad&sort=date</code>.",
"requirement": "recommended",
"caption": "HTTP Query String",
"type_name": "String",
"_source": "url"
}
},
{
"categories": {
"type": "string_t",
"description": "The Website categorization names, as defined by <code>category_ids</code> enum values.",
"is_array": true,
"requirement": "optional",
"caption": "Website Categorization",
"type_name": "String",
"_source": "url",
"_sibling_of": "category_ids"
}
},
{
"category_ids": {
"type": "integer_t",
"enum": {
"5": {
"caption": "Intimate Apparel/Swimsuit"
},
"83": {
"caption": "Peer-to-Peer (P2P)"
},
"35": {
"caption": "Military"
},
"6": {
"caption": "Nudity"
},
"93": {
"caption": "Sexual Expression"
},
"65": {
"caption": "Sports/Recreation"
},
"64": {
"caption": "Restaurants/Dining/Food"
},
"11": {
"caption": "Gambling"
},
"49": {
"caption": "Reference"
},
"32": {
"caption": "Brokerage/Trading"
},
"51": {
"caption": "Chat (IM)/SMS"
},
"27": {
"caption": "Education"
},
"97": {
"caption": "Content Servers"
},
"66": {
"caption": "Travel"
},
"50": {
"caption": "Mixed Content/Potentially Adult"
},
"96": {
"caption": "Non-Viewable/Infrastructure"
},
"86": {
"caption": "Proxy Avoidance"
},
"98": {
"caption": "Placeholders"
},
"52": {
"caption": "Email"
},
"25": {
"caption": "Controlled Substances"
},
"38": {
"caption": "Technology/Internet"
},
"85": {
"caption": "Office/Business Applications"
},
"110": {
"caption": "Internet Telephony"
},
"23": {
"caption": "Alcohol"
},
"29": {
"caption": "Charitable Organizations"
},
"118": {
"caption": "Piracy/Copyright Concerns"
},
"53": {
"caption": "Newsgroups/Forums"
},
"56": {
"caption": "File Storage/Sharing"
},
"3": {
"caption": "Pornography"
},
"36": {
"caption": "Political/Social Advocacy"
},
"17": {
"caption": "Hacking"
},
"9": {
"caption": "Scam/Questionable/Illegal"
},
"63": {
"caption": "Personal Sites"
},
"89": {
"caption": "Web Hosting"
},
"112": {
"caption": "Media Sharing"
},
"121": {
"caption": "Marijuana"
},
"44": {
"caption": "Malicious Outbound Data/Botnets"
},
"107": {
"caption": "Informational"
},
"68": {
"caption": "Humor/Jokes"
},
"33": {
"caption": "Games"
},
"92": {
"caption": "Suspicious"
},
"114": {
"caption": "TV/Video Streams"
},
"106": {
"caption": "E-Card/Invitations"
},
"45": {
"caption": "Job Search/Careers"
},
"108": {
"caption": "Computer/Information Security"
},
"55": {
"caption": "Social Networking"
},
"84": {
"caption": "Audio/Video Clips"
},
"101": {
"caption": "Spam"
},
"111": {
"caption": "Online Meetings"
},
"87": {
"caption": "For Kids"
},
"4": {
"caption": "Sex Education"
},
"0": {
"description": "The Domain/URL category is unknown.",
"caption": "Unknown"
},
"15": {
"caption": "Weapons"
},
"88": {
"caption": "Web Ads/Analytics"
},
"20": {
"caption": "Entertainment"
},
"40": {
"caption": "Search Engines/Portals"
},
"18": {
"caption": "Phishing"
},
"71": {
"caption": "Software Downloads"
},
"61": {
"caption": "Society/Daily Living"
},
"30": {
"caption": "Art/Culture"
},
"22": {
"caption": "Alternative Spirituality/Belief"
},
"47": {
"caption": "Personals/Dating"
},
"14": {
"caption": "Violence/Hate/Racism"
},
"59": {
"caption": "Auctions"
},
"58": {
"caption": "Shopping"
},
"60": {
"caption": "Real Estate"
},
"95": {
"caption": "Translation"
},
"113": {
"caption": "Radio/Audio Streams"
},
"16": {
"caption": "Abortion"
},
"54": {
"caption": "Religion"
},
"46": {
"caption": "News/Media"
},
"67": {
"caption": "Vehicles"
},
"103": {
"caption": "Dynamic DNS Host"
},
"24": {
"caption": "Tobacco"
},
"57": {
"caption": "Remote Access Tools"
},
"109": {
"caption": "Internet Connected Devices"
},
"102": {
"caption": "Potentially Unwanted Software"
},
"7": {
"caption": "Extreme"
},
"99": {
"description": "The Domain/URL category is not mapped. See the <code>categories</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"34": {
"caption": "Government/Legal"
},
"26": {
"caption": "Child Pornography"
},
"43": {
"caption": "Malicious Sources/Malnets"
},
"90": {
"caption": "Uncategorized"
},
"37": {
"caption": "Health"
},
"31": {
"caption": "Financial Services"
},
"21": {
"caption": "Business/Economy"
},
"1": {
"caption": "Adult/Mature Content"
}
},
"description": "The Website categorization identifiers.",
"is_array": true,
"requirement": "recommended",
"caption": "Website Categorization IDs",
"type_name": "Integer",
"sibling": "categories",
"_source": "url"
}
},
{
"resource_type": {
"type": "string_t",
"description": "The context in which a resource was retrieved in a web request.",
"requirement": "optional",
"caption": "Resource Type",
"type_name": "String",
"_source": "url"
}
},
{
"subdomain": {
"type": "string_t",
"description": "The subdomain portion of the URL. For example: <code>sub</code> in <code>https://sub.example.com</code> or <code>sub2.sub1</code> in <code>https://sub2.sub1.example.com</code>.",
"requirement": "optional",
"caption": "Subdomain",
"type_name": "String",
"_source": "url"
}
},
{
"url_string": {
"type": "url_t",
"description": "The URL string. See RFC 1738. For example: <code>http://www.example.com/download/trouble.exe</code>. Note: The URL path should not populate the URL string.",
"requirement": "recommended",
"caption": "URL String",
"type_name": "URL String",
"_source": "url"
}
}
],
"name": "url",
"description": "The Uniform Resource Locator (URL) object describes the characteristics of a URL.",
"extends": "object",
"constraints": {
"at_least_one": [
"url_string",
"path"
]
},
"references": [
{
"description": "Defined in RFC 1738",
"url": "https://datatracker.ietf.org/doc/html/rfc1738"
},
{
"description": "D3FEND\u2122 Ontology d3f:URL",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:URL/"
}
],
"caption": "Uniform Resource Locator",
"observable": 23
}
crates/openshell-ocsf/schemas/ocsf/v1.8.0/objects/network_connection_info.json
Generated
+230
View File
@@ -0,0 +1,230 @@
{
"attributes": {
"session": {
"type": "object_t",
"description": "The authenticated user or service session.",
"requirement": "optional",
"object_type": "session",
"object_name": "Session",
"caption": "Session"
},
"uid": {
"type": "string_t",
"description": "The unique identifier of the connection.",
"requirement": "recommended",
"caption": "Connection UID",
"type_name": "String"
},
"boundary": {
"type": "string_t",
"description": "The boundary of the connection, normalized to the caption of 'boundary_id'. In the case of 'Other', it is defined by the event source. <p> For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.</p>",
"requirement": "optional",
"caption": "Boundary",
"type_name": "String"
},
"protocol_name": {
"type": "string_t",
"description": "The IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: <code>tcp</code> or <code>udp</code>.",
"references": [
{
"description": "IANA Protocol Numbers",
"url": "https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"
}
],
"requirement": "recommended",
"caption": "Protocol Name",
"type_name": "String"
},
"direction": {
"type": "string_t",
"description": "The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source.",
"requirement": "optional",
"caption": "Direction",
"type_name": "String"
},
"boundary_id": {
"type": "integer_t",
"enum": {
"3": {
"description": "External network traffic between two endpoints on the Internet or outside the network.",
"caption": "External"
},
"6": {
"description": "Through a virtual private gateway",
"caption": "Virtual Private Gateway"
},
"0": {
"description": "The connection boundary is unknown.",
"caption": "Unknown"
},
"1": {
"description": "Local network traffic on the same endpoint.",
"caption": "Localhost"
},
"2": {
"description": "Internal network traffic between two endpoints inside network.",
"caption": "Internal"
},
"99": {
"description": "The boundary is not mapped. See the <code>boundary</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "Through another resource in the same VPC",
"caption": "Same VPC"
},
"5": {
"description": "Through an Internet gateway or a gateway VPC endpoint",
"caption": "Internet/VPC Gateway"
},
"7": {
"description": "Through an intra-region VPC peering connection",
"caption": "Intra-region VPC"
},
"8": {
"description": "Through an inter-region VPC peering connection",
"caption": "Inter-region VPC"
},
"9": {
"description": "Through a local gateway",
"caption": "Local Gateway"
},
"10": {
"description": "Through a gateway VPC endpoint (Nitro-based instances only)",
"caption": "Gateway VPC"
},
"11": {
"description": "Through an Internet gateway (Nitro-based instances only)",
"caption": "Internet Gateway"
}
},
"description": "<p>The normalized identifier of the boundary of the connection. </p><p> For cloud connections, this translates to the traffic-boundary (same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.</p>",
"requirement": "recommended",
"sibling": "boundary",
"caption": "Boundary ID",
"type_name": "Integer"
},
"community_uid": {
"type": "string_t",
"description": "The Community ID of the network connection.",
"source": "community_id",
"references": [
{
"description": "Community ID definition.",
"url": "https://github.com/corelight/community-id-spec"
}
],
"requirement": "optional",
"caption": "Community ID",
"type_name": "String"
},
"direction_id": {
"type": "integer_t",
"enum": {
"3": {
"description": "Lateral network connection. The connection originated from inside the network, destined for services on the inside network.",
"caption": "Lateral"
},
"0": {
"description": "The connection direction is unknown.",
"caption": "Unknown"
},
"1": {
"description": "Inbound network connection. The connection originated from the Internet or outside network, destined for services on the inside network.",
"caption": "Inbound"
},
"2": {
"description": "Outbound network connection. The connection originated from inside the network, destined for services on the Internet or outside network.",
"caption": "Outbound"
},
"99": {
"description": "The direction is not mapped. See the <code>direction</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"description": "Local network connection (<code>localhost</code>). The connection is intra-device, originating from and destined for services running on the same device.",
"caption": "Local"
}
},
"description": "The normalized identifier of the direction of the initiated connection, traffic, or email.",
"requirement": "required",
"sibling": "direction",
"caption": "Direction ID",
"type_name": "Integer"
},
"flag_history": {
"type": "string_t",
"description": "The Connection Flag History summarizes events in a network connection. For example flags <code> ShAD </code> representing SYN, SYN/ACK, ACK and Data exchange.",
"references": [
{
"description": "Zeek History",
"url": "https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is"
}
],
"requirement": "optional",
"caption": "Connection Flag History",
"type_name": "String"
},
"protocol_num": {
"type": "integer_t",
"description": "The IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: <code>6</code> for TCP and <code>17</code> for UDP.",
"references": [
{
"description": "IANA Protocol Numbers",
"url": "https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"
}
],
"requirement": "recommended",
"caption": "Protocol Number",
"type_name": "Integer"
},
"protocol_ver": {
"type": "string_t",
"description": "The Internet Protocol version.",
"requirement": "optional",
"caption": "IP Version",
"type_name": "String"
},
"protocol_ver_id": {
"type": "integer_t",
"enum": {
"6": {
"caption": "Internet Protocol version 6 (IPv6)"
},
"0": {
"description": "The protocol version is unknown.",
"caption": "Unknown"
},
"99": {
"description": "The protocol version is not mapped. See the <code>protocol_ver</code> attribute, which contains a data source specific value.",
"caption": "Other"
},
"4": {
"caption": "Internet Protocol version 4 (IPv4)"
}
},
"description": "The Internet Protocol version identifier.",
"requirement": "recommended",
"sibling": "protocol_ver",
"caption": "IP Version ID",
"type_name": "Integer"
},
"tcp_flags": {
"type": "integer_t",
"description": "The network connection TCP header flags (i.e., control bits).",
"requirement": "optional",
"caption": "TCP Flags",
"type_name": "Integer"
}
},
"name": "network_connection_info",
"description": "The Network Connection Information object describes characteristics of an OSI Transport Layer communication, including TCP and UDP.",
"extends": "object",
"references": [
{
"description": "D3FEND\u2122 Ontology d3f:NetworkSession",
"url": "https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/"
}
],
"caption": "Network Connection Information"
}
crates/openshell-ocsf/schemas/ocsf/v1.8.0/objects/tactic.json
Generated
+45
View File
@@ -0,0 +1,45 @@
{
"attributes": {
"name": {
"type": "string_t",
"description": "The Tactic name that is associated with the attack technique. For example: <code>Reconnaissance</code> or <code>ML Model Access</code>.",
"requirement": "recommended",
"caption": "Name",
"type_name": "String"
},
"uid": {
"type": "string_t",
"description": "The Tactic ID that is associated with the attack technique. For example: <code>TA0043</code>, or <code>AML.TA0000</code>.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String"
},
"src_url": {
"type": "url_t",
"description": "The versioned permalink of the Tactic. For example: <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.",
"requirement": "optional",
"caption": "Source URL",
"type_name": "URL String"
}
},
"name": "tactic",
"description": "The MITRE Tactic object describes the ATT&CK\u00ae or ATLAS\u2122 Tactic ID and/or name that is associated to an attack.",
"extends": "_entity",
"constraints": {
"at_least_one": [
"name",
"uid"
]
},
"references": [
{
"description": "ATT&CK\u00ae Matrix",
"url": "https://attack.mitre.org"
},
{
"description": "ATLAS\u2122 Matrix",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"caption": "MITRE Tactic"
}
crates/openshell-ocsf/schemas/ocsf/v1.8.0/objects/technique.json
Generated
+45
View File
@@ -0,0 +1,45 @@
{
"attributes": {
"name": {
"type": "string_t",
"description": "The name of the attack technique. For example: <code>Active Scanning</code> or <code>AI Model Inference API Access</code>.",
"requirement": "recommended",
"caption": "Name",
"type_name": "String"
},
"uid": {
"type": "string_t",
"description": "The unique identifier of the attack technique. For example: <code>T1595</code> or <code>AML.T0040</code>.",
"requirement": "recommended",
"caption": "Unique ID",
"type_name": "String"
},
"src_url": {
"type": "url_t",
"description": "The versioned permalink of the attack technique. For example: <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.",
"requirement": "optional",
"caption": "Source URL",
"type_name": "URL String"
}
},
"name": "technique",
"description": "The MITRE Technique object describes the ATT&CK\u00ae or ATLAS\u2122 Technique ID and/or name associated to an attack.",
"extends": "_entity",
"constraints": {
"at_least_one": [
"name",
"uid"
]
},
"references": [
{
"description": "ATT&CK\u00ae Matrix",
"url": "https://attack.mitre.org"
},
{
"description": "ATLAS\u2122 Matrix",
"url": "https://atlas.mitre.org/matrices/ATLAS"
}
],
"caption": "MITRE Technique"
}
crates/openshell-ocsf/src/builders/http.rs
+2 -2
View File
@@ -42,7 +42,7 @@ impl<'a> HttpActivityBuilder<'a, MissingHttpContext> {
/// be built.
///
/// ```compile_fail
/// use openshell_ocsf::{EventContext, HttpActivityBuilder};
/// use openshell_ocsf::{EventContext, EventOrigin, HttpActivityBuilder};
///
/// let ctx = EventContext {
/// sandbox_id: String::new(),
@@ -52,6 +52,7 @@ impl<'a> HttpActivityBuilder<'a, MissingHttpContext> {
/// product_version: String::new(),
/// proxy_ip: "127.0.0.1".parse().unwrap(),
/// proxy_port: 3128,
/// origin: EventOrigin::Supervisor,
/// };
/// HttpActivityBuilder::new(&ctx).build();
/// ```
@@ -254,7 +255,6 @@ impl HttpActivityBuilder<'_, HasHttpContext> {
action: self.action,
disposition: self.disposition,
observation_point_id: Some(2),
is_src_dst_assignment_known: Some(true),
})
}
}
crates/openshell-ocsf/src/builders/mod.rs
+122 -43
View File
@@ -91,49 +91,6 @@ macro_rules! impl_action_disposition_setters {
};
}
/// Generate the `actor_process` setter shared by network, HTTP, SSH, and
/// process-activity builders.
macro_rules! impl_actor_process_setter {
($builder:ident) => {
impl<'a> $builder<'a> {
/// Set the acting process.
#[must_use]
pub fn actor_process(mut self, process: $crate::objects::Process) -> Self {
self.actor = Some($crate::objects::Actor::process(process));
self
}
}
};
}
/// Generate the `dst_endpoint` setter shared by network, HTTP, and SSH builders.
macro_rules! impl_dst_endpoint_setter {
($builder:ident) => {
impl<'a> $builder<'a> {
/// Set the destination endpoint.
#[must_use]
pub fn dst_endpoint(mut self, endpoint: $crate::objects::Endpoint) -> Self {
self.dst_endpoint = Some(endpoint);
self
}
}
};
}
/// Generate the `src_endpoint_addr` setter shared by network and SSH builders.
macro_rules! impl_src_endpoint_addr_setter {
($builder:ident) => {
impl<'a> $builder<'a> {
/// Set the source endpoint from a raw IP address and port.
#[must_use]
pub fn src_endpoint_addr(mut self, ip: std::net::IpAddr, port: u16) -> Self {
self.src_endpoint = Some($crate::objects::Endpoint::from_ip(ip, port));
self
}
}
};
}
mod api_activity;
mod authentication;
mod base;
@@ -324,6 +281,114 @@ pub(crate) fn test_sandbox_context() -> EventContext {
}
}
/// One event per builder, as production emits them, for schema conformance tests.
#[cfg(test)]
pub(crate) fn sample_events(ctx: &EventContext) -> Vec<(&'static str, crate::OcsfEvent)> {
use crate::{
ActionId, ActivityId, AiModel, ConnectionInfo, DispositionId, Endpoint, FindingInfo,
HttpRequest, HttpResponse, Process, Service, SeverityId, StateId, Url, User,
};
let peer = IpAddr::V4(std::net::Ipv4Addr::new(10, 0, 0, 5));
vec![
(
"network_activity",
NetworkActivityBuilder::new(ctx)
.activity(ActivityId::Open)
.action(ActionId::Allowed)
.disposition(DispositionId::Allowed)
.src_endpoint_addr(peer, 51234)
.dst_endpoint(Endpoint::from_domain("api.example.com", 443))
.connection_info(ConnectionInfo::new("tcp"))
.actor_process(Process::new("curl", 42))
.firewall_rule("default", "opa")
.build(),
),
(
"http_activity",
HttpActivityBuilder::new(ctx)
.activity(ActivityId::Reset)
.action(ActionId::Denied)
.disposition(DispositionId::Blocked)
.http_request(HttpRequest::new(
"GET",
Url::new("https", "api.example.com", "/v1", 443),
))
.http_response(HttpResponse { code: 403 })
.src_endpoint(Endpoint::from_ip(peer, 51234))
.dst_endpoint(Endpoint::from_domain("api.example.com", 443))
.actor_process(Process::new("curl", 42))
.build(),
),
(
"ssh_activity",
SshActivityBuilder::new(ctx)
.activity(ActivityId::Open)
.src_endpoint_addr(peer, 44321)
.dst_endpoint(Endpoint::from_domain("sandbox.local", 22))
.build(),
),
(
"process_activity",
ProcessActivityBuilder::new(ctx)
.activity(ActivityId::Open)
.process(Process::new("python3", 4713))
.actor_process(Process::new("openshell-sandbox", 1))
.build(),
),
(
"detection_finding",
DetectionFindingBuilder::new(ctx)
.activity(ActivityId::Open)
.severity(SeverityId::High)
.is_alert(true)
.confidence(crate::ConfidenceId::High)
.risk_level(crate::RiskLevelId::High)
.finding_info(FindingInfo::new("finding-1", "Nonce replay"))
.evidence_pairs(&[("nonce", "0xdeadbeef"), ("peer", "10.0.0.5")])
.remediation("Rotate the sandbox SSH keys.")
.attack(crate::Attack::mitre(
"T1550",
"Use Alternate Authentication Material",
"TA0008",
"Lateral Movement",
))
.message("Nonce replay detected")
.build(),
),
(
"application_lifecycle",
AppLifecycleBuilder::new(ctx)
.activity(ActivityId::Open)
.build(),
),
(
"device_config_state_change",
ConfigStateChangeBuilder::new(ctx)
.state(StateId::Enabled, "loaded")
.build(),
),
("base_event", BaseEventBuilder::new(ctx).build()),
(
"api_activity",
ApiActivityBuilder::new(ctx, "chat.completions")
.dst_endpoint(Endpoint::from_domain("api.example.com", 443))
.ai_model(AiModel::new("model", "provider"))
.build(),
),
(
"authentication",
AuthenticationBuilder::new(
ctx,
User::unidentified(),
Service::new("openshell-gateway"),
)
.src_endpoint(Endpoint::from_ip(peer, 51234))
.build(),
),
]
}
#[cfg(test)]
pub(crate) fn test_gateway_context() -> EventContext {
EventContext {
@@ -368,6 +433,20 @@ mod tests {
validate_enum_value(&device, "type_id", &schema);
}
/// One event per builder, built with a production-like sandbox context
/// (container image set), must validate against the vendored 1.8.0 schemas.
#[test]
fn every_builder_emits_schema_conformant_events() {
use crate::validation::schema::{load_class_schema, validate_required_fields};
let ctx = test_sandbox_context();
let events = sample_events(&ctx);
for (class, event) in &events {
let json = event.to_json().unwrap();
validate_required_fields(&json, &load_class_schema(class));
}
}
#[test]
fn test_sandbox_context_container() {
let ctx = test_sandbox_context();
crates/openshell-ocsf/src/builders/network.rs
+2 -1
View File
@@ -44,7 +44,7 @@ impl<'a> NetworkActivityBuilder<'a, MissingNetworkEndpoint> {
/// it can be built.
///
/// ```compile_fail
/// use openshell_ocsf::{EventContext, NetworkActivityBuilder};
/// use openshell_ocsf::{EventContext, EventOrigin, NetworkActivityBuilder};
///
/// let ctx = EventContext {
/// sandbox_id: String::new(),
@@ -54,6 +54,7 @@ impl<'a> NetworkActivityBuilder<'a, MissingNetworkEndpoint> {
/// product_version: String::new(),
/// proxy_ip: "127.0.0.1".parse().unwrap(),
/// proxy_port: 3128,
/// origin: EventOrigin::Supervisor,
/// };
/// NetworkActivityBuilder::new(&ctx).build();
/// ```
crates/openshell-ocsf/src/builders/process.rs
+89 -7
View File
@@ -10,7 +10,7 @@ use crate::events::{OcsfEvent, ProcessActivityEvent};
use crate::objects::{Actor, Process};
/// Builder for Process Activity [1007] events.
pub struct ProcessActivityBuilder<'a> {
pub struct ProcessActivityBuilder<'a, ActorState = MissingActor> {
ctx: ContextRef<'a>,
activity: ActivityId,
severity: SeverityId,
@@ -22,9 +22,35 @@ pub struct ProcessActivityBuilder<'a> {
launch_type: Option<LaunchTypeId>,
exit_code: Option<i32>,
message: Option<String>,
actor_state: std::marker::PhantomData<ActorState>,
}
impl<'a> ProcessActivityBuilder<'a> {
/// Marker for a Process Activity builder without an acting process.
pub struct MissingActor;
/// Marker for a Process Activity builder with an acting process.
pub struct HasActor;
impl<'a> ProcessActivityBuilder<'a, MissingActor> {
/// Start building a Process Activity event.
///
/// A Process Activity must name its acting process before it can be built.
///
/// ```compile_fail
/// use openshell_ocsf::{EventContext, EventOrigin, ProcessActivityBuilder};
///
/// let ctx = EventContext {
/// sandbox_id: String::new(),
/// sandbox_name: String::new(),
/// container_image: String::new(),
/// hostname: String::new(),
/// product_version: String::new(),
/// proxy_ip: "127.0.0.1".parse().unwrap(),
/// proxy_port: 3128,
/// origin: EventOrigin::Supervisor,
/// };
/// ProcessActivityBuilder::new(&ctx).build();
/// ```
#[must_use]
pub fn new(ctx: impl Into<ContextRef<'a>>) -> Self {
Self {
@@ -39,9 +65,67 @@ impl<'a> ProcessActivityBuilder<'a> {
launch_type: None,
exit_code: None,
message: None,
actor_state: std::marker::PhantomData,
}
}
/// Set the acting process. Required by the OCSF schema.
#[must_use]
pub fn actor_process(self, process: Process) -> ProcessActivityBuilder<'a, HasActor> {
ProcessActivityBuilder {
ctx: self.ctx,
activity: self.activity,
severity: self.severity,
status: self.status,
action: self.action,
disposition: self.disposition,
process: self.process,
actor: Some(Actor::process(process)),
launch_type: self.launch_type,
exit_code: self.exit_code,
message: self.message,
actor_state: std::marker::PhantomData,
}
}
}
impl<ActorState> ProcessActivityBuilder<'_, ActorState> {
/// Set the event activity identifier.
#[must_use]
pub fn activity(mut self, id: ActivityId) -> Self {
self.activity = id;
self
}
/// Set the action taken.
#[must_use]
pub fn action(mut self, id: ActionId) -> Self {
self.action = Some(id);
self
}
/// Set the disposition of the action.
#[must_use]
pub fn disposition(mut self, id: DispositionId) -> Self {
self.disposition = Some(id);
self
}
/// Set the event severity.
#[must_use]
pub fn severity(mut self, id: SeverityId) -> Self {
self.severity = id;
self
}
/// Set the overall event status.
#[must_use]
pub fn status(mut self, id: StatusId) -> Self {
self.status = Some(id);
self
}
/// Set a human-readable event message.
#[must_use]
pub fn message(mut self, msg: impl Into<String>) -> Self {
self.message = Some(msg.into());
self
}
#[must_use]
pub fn process(mut self, proc: Process) -> Self {
self.process = Some(proc);
@@ -57,7 +141,9 @@ impl<'a> ProcessActivityBuilder<'a> {
self.exit_code = Some(code);
self
}
}
impl ProcessActivityBuilder<'_, HasActor> {
#[must_use]
pub fn build(self) -> OcsfEvent {
let activity_name = self.activity.process_label().to_string();
@@ -87,11 +173,6 @@ impl<'a> ProcessActivityBuilder<'a> {
}
}
impl_activity_setter!(ProcessActivityBuilder);
impl_action_disposition_setters!(ProcessActivityBuilder);
impl_actor_process_setter!(ProcessActivityBuilder);
impl_builder_setters!(ProcessActivityBuilder);
#[cfg(test)]
mod tests {
use super::*;
@@ -125,6 +206,7 @@ mod tests {
.activity(ActivityId::Close) // Terminate
.severity(SeverityId::Informational)
.process(Process::new("python3", 42))
.actor_process(Process::new("openshell-sandbox", 1))
.exit_code(0)
.build();
crates/openshell-ocsf/src/builders/ssh.rs
+129 -9
View File
@@ -10,7 +10,7 @@ use crate::events::{OcsfEvent, SshActivityEvent};
use crate::objects::{Actor, Endpoint};
/// Builder for SSH Activity [4007] events.
pub struct SshActivityBuilder<'a> {
pub struct SshActivityBuilder<'a, EndpointState = MissingSshEndpoint> {
ctx: ContextRef<'a>,
activity: ActivityId,
action: Option<ActionId>,
@@ -24,9 +24,36 @@ pub struct SshActivityBuilder<'a> {
auth_type_label: Option<String>,
protocol_ver: Option<String>,
message: Option<String>,
endpoint_state: std::marker::PhantomData<EndpointState>,
}
impl<'a> SshActivityBuilder<'a> {
/// Marker for an SSH Activity builder without a source or destination endpoint.
pub struct MissingSshEndpoint;
/// Marker for an SSH Activity builder with a source or destination endpoint.
pub struct HasSshEndpoint;
impl<'a> SshActivityBuilder<'a, MissingSshEndpoint> {
/// Start building an SSH Activity event.
///
/// An SSH Activity must identify a source or destination endpoint before it
/// can be built.
///
/// ```compile_fail
/// use openshell_ocsf::{EventContext, EventOrigin, SshActivityBuilder};
///
/// let ctx = EventContext {
/// sandbox_id: String::new(),
/// sandbox_name: String::new(),
/// container_image: String::new(),
/// hostname: String::new(),
/// product_version: String::new(),
/// proxy_ip: "127.0.0.1".parse().unwrap(),
/// proxy_port: 3128,
/// origin: EventOrigin::Supervisor,
/// };
/// SshActivityBuilder::new(&ctx).build();
/// ```
#[must_use]
pub fn new(ctx: impl Into<ContextRef<'a>>) -> Self {
Self {
@@ -43,6 +70,55 @@ impl<'a> SshActivityBuilder<'a> {
auth_type_label: None,
protocol_ver: None,
message: None,
endpoint_state: std::marker::PhantomData,
}
}
}
impl<'a, EndpointState> SshActivityBuilder<'a, EndpointState> {
/// Set the source endpoint from an address.
#[must_use]
pub fn src_endpoint_addr(
self,
ip: std::net::IpAddr,
port: u16,
) -> SshActivityBuilder<'a, HasSshEndpoint> {
SshActivityBuilder {
src_endpoint: Some(Endpoint::from_ip(ip, port)),
dst_endpoint: self.dst_endpoint,
ctx: self.ctx,
activity: self.activity,
action: self.action,
disposition: self.disposition,
severity: self.severity,
status: self.status,
actor: self.actor,
auth_type_id: self.auth_type_id,
auth_type_label: self.auth_type_label,
protocol_ver: self.protocol_ver,
message: self.message,
endpoint_state: std::marker::PhantomData,
}
}
/// Set the destination endpoint.
#[must_use]
pub fn dst_endpoint(self, endpoint: Endpoint) -> SshActivityBuilder<'a, HasSshEndpoint> {
SshActivityBuilder {
src_endpoint: self.src_endpoint,
dst_endpoint: Some(endpoint),
ctx: self.ctx,
activity: self.activity,
action: self.action,
disposition: self.disposition,
severity: self.severity,
status: self.status,
actor: self.actor,
auth_type_id: self.auth_type_id,
auth_type_label: self.auth_type_label,
protocol_ver: self.protocol_ver,
message: self.message,
endpoint_state: std::marker::PhantomData,
}
}
@@ -60,6 +136,57 @@ impl<'a> SshActivityBuilder<'a> {
self
}
/// Set the event activity identifier.
#[must_use]
pub fn activity(mut self, id: ActivityId) -> Self {
self.activity = id;
self
}
/// Set the action taken.
#[must_use]
pub fn action(mut self, id: ActionId) -> Self {
self.action = Some(id);
self
}
/// Set the disposition of the action.
#[must_use]
pub fn disposition(mut self, id: DispositionId) -> Self {
self.disposition = Some(id);
self
}
/// Set the acting process.
#[must_use]
pub fn actor_process(mut self, process: crate::objects::Process) -> Self {
self.actor = Some(Actor::process(process));
self
}
/// Set the event severity.
#[must_use]
pub fn severity(mut self, id: SeverityId) -> Self {
self.severity = id;
self
}
/// Set the overall event status.
#[must_use]
pub fn status(mut self, id: StatusId) -> Self {
self.status = Some(id);
self
}
/// Set a human-readable event message.
#[must_use]
pub fn message(mut self, msg: impl Into<String>) -> Self {
self.message = Some(msg.into());
self
}
}
impl SshActivityBuilder<'_, HasSshEndpoint> {
#[must_use]
pub fn build(self) -> OcsfEvent {
let activity_name = self.activity.network_label().to_string();
@@ -91,13 +218,6 @@ impl<'a> SshActivityBuilder<'a> {
}
}
impl_activity_setter!(SshActivityBuilder);
impl_action_disposition_setters!(SshActivityBuilder);
impl_actor_process_setter!(SshActivityBuilder);
impl_dst_endpoint_setter!(SshActivityBuilder);
impl_src_endpoint_addr_setter!(SshActivityBuilder);
impl_builder_setters!(SshActivityBuilder);
#[cfg(test)]
mod tests {
use super::*;
crates/openshell-ocsf/src/ctx.rs
+11 -3
View File
@@ -16,10 +16,18 @@ use std::sync::{Arc, LazyLock, OnceLock};
static OCSF_CTX: OnceLock<EventContext> = OnceLock::new();
/// With `test-support`, producer tests get a production-like sandbox identity
/// so their events carry the same container and device fields production does.
#[cfg(any(test, feature = "test-support"))]
const FALLBACK_SANDBOX: (&str, &str, &str) =
("sandbox-test", "test-sandbox", "example/sandbox:test");
#[cfg(not(any(test, feature = "test-support")))]
const FALLBACK_SANDBOX: (&str, &str, &str) = ("", "", "");
static OCSF_CTX_FALLBACK: LazyLock<EventContext> = LazyLock::new(|| EventContext {
sandbox_id: String::new(),
sandbox_name: String::new(),
container_image: String::new(),
sandbox_id: FALLBACK_SANDBOX.0.to_string(),
sandbox_name: FALLBACK_SANDBOX.1.to_string(),
container_image: FALLBACK_SANDBOX.2.to_string(),
hostname: "test".to_string(),
product_version: env!("CARGO_PKG_VERSION").to_string(),
proxy_ip: std::net::IpAddr::from([127, 0, 0, 1]),
crates/openshell-ocsf/src/enums/connection_direction.rs
+70
View File
@@ -0,0 +1,70 @@
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0
//! OCSF `connection_info.direction_id` enum.
use serde_repr::{Deserialize_repr, Serialize_repr};
/// OCSF Network Connection Direction ID.
///
/// Values come from the OCSF `network_connection_info` `direction_id`
/// enumeration.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize_repr, Deserialize_repr)]
#[repr(u8)]
pub enum ConnectionDirectionId {
/// 0 — Unknown
Unknown = 0,
/// 1 — Inbound
Inbound = 1,
/// 2 — Outbound
Outbound = 2,
/// 3 — Lateral
Lateral = 3,
/// 4 — Local
Local = 4,
/// 99 — Other
Other = 99,
}
impl ConnectionDirectionId {
#[must_use]
pub fn as_u8(self) -> u8 {
self as u8
}
}
impl std::fmt::Display for ConnectionDirectionId {
fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
formatter.write_str(match self {
Self::Unknown => "Unknown",
Self::Inbound => "Inbound",
Self::Outbound => "Outbound",
Self::Lateral => "Lateral",
Self::Local => "Local",
Self::Other => "Other",
})
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn connection_direction_json_roundtrip() {
for (direction, expected, label) in [
(ConnectionDirectionId::Unknown, 0, "Unknown"),
(ConnectionDirectionId::Inbound, 1, "Inbound"),
(ConnectionDirectionId::Outbound, 2, "Outbound"),
(ConnectionDirectionId::Lateral, 3, "Lateral"),
(ConnectionDirectionId::Local, 4, "Local"),
(ConnectionDirectionId::Other, 99, "Other"),
] {
let json = serde_json::to_value(direction).unwrap();
assert_eq!(json, serde_json::json!(expected));
let decoded: ConnectionDirectionId = serde_json::from_value(json).unwrap();
assert_eq!(decoded, direction);
assert_eq!(direction.to_string(), label);
}
}
}
crates/openshell-ocsf/src/enums/mod.rs
+2
View File
@@ -7,6 +7,7 @@ mod action;
mod activity;
mod auth;
mod auth_protocol;
mod connection_direction;
mod device_type;
mod disposition;
mod http_method;
@@ -21,6 +22,7 @@ pub use action::ActionId;
pub use activity::ActivityId;
pub use auth::AuthTypeId;
pub use auth_protocol::AuthProtocolId;
pub use connection_direction::ConnectionDirectionId;
pub use device_type::DeviceTypeId;
pub use disposition::DispositionId;
pub use http_method::HttpMethod;
crates/openshell-ocsf/src/events/http_activity.rs
-10
View File
@@ -61,10 +61,6 @@ pub struct HttpActivityEvent {
/// Observation point ID (v1.6.0+).
#[serde(skip_serializing_if = "Option::is_none")]
pub observation_point_id: Option<u8>,
/// Whether src/dst assignment is known (v1.6.0+).
#[serde(skip_serializing_if = "Option::is_none")]
pub is_src_dst_assignment_known: Option<bool>,
}
impl Serialize for HttpActivityEvent {
@@ -86,11 +82,6 @@ impl Serialize for HttpActivityEvent {
insert_enum_pair!(obj, "action", self.action);
insert_enum_pair!(obj, "disposition", self.disposition);
insert_optional!(obj, "observation_point_id", self.observation_point_id);
insert_optional!(
obj,
"is_src_dst_assignment_known",
self.is_src_dst_assignment_known
);
base_val.serialize(serializer)
}
@@ -135,7 +126,6 @@ mod tests {
action: Some(ActionId::Allowed),
disposition: Some(DispositionId::Allowed),
observation_point_id: None,
is_src_dst_assignment_known: None,
};
let json = serde_json::to_value(&event).unwrap();
crates/openshell-ocsf/src/events/mod.rs
+2
View File
@@ -214,6 +214,7 @@ mod tests {
.activity(ActivityId::Open)
.action(ActionId::Allowed)
.severity(SeverityId::Informational)
.dst_endpoint(Endpoint::from_domain("sandbox.local", 22))
.build();
let json = serde_json::to_value(&event).unwrap();
@@ -229,6 +230,7 @@ mod tests {
.activity(ActivityId::Open)
.severity(SeverityId::Informational)
.process(Process::new("test", 1))
.actor_process(Process::new("openshell-sandbox", 1))
.build();
let json = serde_json::to_value(&event).unwrap();
crates/openshell-ocsf/src/format/shorthand.rs
-6
View File
@@ -785,7 +785,6 @@ mod tests {
action: Some(ActionId::Allowed),
disposition: None,
observation_point_id: None,
is_src_dst_assignment_known: None,
});
let shorthand = event.format_shorthand();
@@ -815,7 +814,6 @@ mod tests {
action: Some(ActionId::Allowed),
disposition: Some(DispositionId::Allowed),
observation_point_id: None,
is_src_dst_assignment_known: None,
});
let shorthand = event.format_shorthand();
@@ -846,7 +844,6 @@ mod tests {
action: Some(ActionId::Allowed),
disposition: Some(DispositionId::Allowed),
observation_point_id: None,
is_src_dst_assignment_known: None,
});
let shorthand = event.format_shorthand();
@@ -873,7 +870,6 @@ mod tests {
action: Some(ActionId::Denied),
disposition: Some(DispositionId::Blocked),
observation_point_id: None,
is_src_dst_assignment_known: None,
});
let denied_shorthand = denied_event.format_shorthand();
@@ -986,7 +982,6 @@ mod tests {
action: Some(ActionId::Denied),
disposition: Some(DispositionId::Blocked),
observation_point_id: None,
is_src_dst_assignment_known: None,
});
let shorthand = event.format_shorthand();
@@ -1107,7 +1102,6 @@ mod tests {
action: Some(ActionId::Allowed),
disposition: None,
observation_point_id: None,
is_src_dst_assignment_known: None,
});
let shorthand = event.format_shorthand();
crates/openshell-ocsf/src/lib.rs
+3 -3
View File
@@ -48,9 +48,9 @@ pub use events::{
// --- Enum types ---
pub use enums::{
ActionId, ActivityId, AuthProtocolId, AuthTypeId, ConfidenceId, DeviceTypeId, DispositionId,
HttpMethod, LaunchTypeId, OcsfEnum, OsTypeId, RiskLevelId, SecurityLevelId, SeverityId,
StateId, StatusId, UserTypeId,
ActionId, ActivityId, AuthProtocolId, AuthTypeId, ConfidenceId, ConnectionDirectionId,
DeviceTypeId, DispositionId, HttpMethod, LaunchTypeId, OcsfEnum, OsTypeId, RiskLevelId,
SecurityLevelId, SeverityId, StateId, StatusId, UserTypeId,
};
// --- Object types ---
crates/openshell-ocsf/src/objects/connection.rs
+15 -1
View File
@@ -5,6 +5,8 @@
use serde::{Deserialize, Serialize};
use crate::enums::ConnectionDirectionId;
/// OCSF Connection Info object.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ConnectionInfo {
@@ -13,14 +15,23 @@ pub struct ConnectionInfo {
/// Kept as `String` because the OCSF spec defines this as free-form
/// `string_t`, and sandbox integration passes runtime-dynamic values.
pub protocol_name: String,
/// Connection direction id. Required by the OCSF schema.
pub direction_id: ConnectionDirectionId,
/// Sibling label for `direction_id`.
pub direction: String,
}
impl ConnectionInfo {
/// Create connection info with the given protocol.
/// Create connection info with the given protocol and an unknown direction.
#[must_use]
pub fn new(protocol: &str) -> Self {
let direction_id = ConnectionDirectionId::Unknown;
Self {
protocol_name: protocol.to_string(),
direction_id,
direction: direction_id.to_string(),
}
}
}
@@ -34,5 +45,8 @@ mod tests {
let info = ConnectionInfo::new("tcp");
let json = serde_json::to_value(&info).unwrap();
assert_eq!(json["protocol_name"], "tcp");
// Required by the OCSF schema; the direction is not known at these call sites.
assert_eq!(json["direction_id"], 0);
assert_eq!(json["direction"], "Unknown");
}
}
crates/openshell-ocsf/src/objects/endpoint.rs
+36
View File
@@ -25,6 +25,10 @@ pub struct Endpoint {
/// Short name for an endpoint with no address of its own.
#[serde(skip_serializing_if = "Option::is_none")]
pub name: Option<String>,
/// Name of the service the endpoint provides.
#[serde(skip_serializing_if = "Option::is_none")]
pub svc_name: Option<String>,
}
impl Endpoint {
@@ -36,6 +40,7 @@ impl Endpoint {
ip: None,
port: Some(port),
name: None,
svc_name: None,
}
}
@@ -47,6 +52,7 @@ impl Endpoint {
ip: None,
port: None,
name: Some(name.to_string()),
svc_name: None,
}
}
@@ -58,6 +64,7 @@ impl Endpoint {
ip: Some(addr.to_string()),
port: Some(port),
name: None,
svc_name: None,
}
}
@@ -69,6 +76,20 @@ impl Endpoint {
ip: Some(addr.to_string()),
port: Some(port),
name: None,
svc_name: None,
}
}
/// Create an endpoint for a local service with no network address, such as
/// a server on a Unix socket.
#[must_use]
pub fn local_service(svc_name: &str, name: Option<&str>) -> Self {
Self {
domain: None,
ip: None,
port: None,
name: name.map(str::to_string),
svc_name: Some(svc_name.to_string()),
}
}
@@ -86,6 +107,21 @@ impl Endpoint {
mod tests {
use super::*;
#[test]
fn local_service_endpoint_names_the_service_and_socket() {
let json = serde_json::to_value(Endpoint::local_service(
"ssh",
Some("/run/openshell/ssh.sock"),
))
.unwrap();
assert_eq!(
json,
serde_json::json!({"name": "/run/openshell/ssh.sock", "svc_name": "ssh"})
);
let json = serde_json::to_value(Endpoint::local_service("ssh", None)).unwrap();
assert_eq!(json, serde_json::json!({"svc_name": "ssh"}));
}
#[test]
fn test_endpoint_domain() {
let ep = Endpoint::from_domain("api.example.com", 443);
crates/openshell-ocsf/src/validation/embedded.rs
+48
View File
@@ -0,0 +1,48 @@
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0
//! Vendored OCSF schemas compiled into the binary.
//!
//! @generated from `schemas/ocsf/`. Do not edit; regenerate with
//! `UPDATE_OCSF_EMBEDDED_SCHEMAS=1 cargo test -p openshell-ocsf embedded_schemas`.
#[rustfmt::skip]
pub(super) static SCHEMAS: &[(&str, &str)] = &[
("v1.8.0/classes/api_activity", include_str!("../../schemas/ocsf/v1.8.0/classes/api_activity.json")),
("v1.8.0/classes/application_lifecycle", include_str!("../../schemas/ocsf/v1.8.0/classes/application_lifecycle.json")),
("v1.8.0/classes/authentication", include_str!("../../schemas/ocsf/v1.8.0/classes/authentication.json")),
("v1.8.0/classes/base_event", include_str!("../../schemas/ocsf/v1.8.0/classes/base_event.json")),
("v1.8.0/classes/detection_finding", include_str!("../../schemas/ocsf/v1.8.0/classes/detection_finding.json")),
("v1.8.0/classes/device_config_state_change", include_str!("../../schemas/ocsf/v1.8.0/classes/device_config_state_change.json")),
("v1.8.0/classes/http_activity", include_str!("../../schemas/ocsf/v1.8.0/classes/http_activity.json")),
("v1.8.0/classes/network_activity", include_str!("../../schemas/ocsf/v1.8.0/classes/network_activity.json")),
("v1.8.0/classes/process_activity", include_str!("../../schemas/ocsf/v1.8.0/classes/process_activity.json")),
("v1.8.0/classes/ssh_activity", include_str!("../../schemas/ocsf/v1.8.0/classes/ssh_activity.json")),
("v1.8.0/objects/actor", include_str!("../../schemas/ocsf/v1.8.0/objects/actor.json")),
("v1.8.0/objects/ai_model", include_str!("../../schemas/ocsf/v1.8.0/objects/ai_model.json")),
("v1.8.0/objects/api", include_str!("../../schemas/ocsf/v1.8.0/objects/api.json")),
("v1.8.0/objects/attack", include_str!("../../schemas/ocsf/v1.8.0/objects/attack.json")),
("v1.8.0/objects/connection_info", include_str!("../../schemas/ocsf/v1.8.0/objects/connection_info.json")),
("v1.8.0/objects/container", include_str!("../../schemas/ocsf/v1.8.0/objects/container.json")),
("v1.8.0/objects/device", include_str!("../../schemas/ocsf/v1.8.0/objects/device.json")),
("v1.8.0/objects/evidences", include_str!("../../schemas/ocsf/v1.8.0/objects/evidences.json")),
("v1.8.0/objects/finding_info", include_str!("../../schemas/ocsf/v1.8.0/objects/finding_info.json")),
("v1.8.0/objects/firewall_rule", include_str!("../../schemas/ocsf/v1.8.0/objects/firewall_rule.json")),
("v1.8.0/objects/http_request", include_str!("../../schemas/ocsf/v1.8.0/objects/http_request.json")),
("v1.8.0/objects/http_response", include_str!("../../schemas/ocsf/v1.8.0/objects/http_response.json")),
("v1.8.0/objects/metadata", include_str!("../../schemas/ocsf/v1.8.0/objects/metadata.json")),
("v1.8.0/objects/network_connection_info", include_str!("../../schemas/ocsf/v1.8.0/objects/network_connection_info.json")),
("v1.8.0/objects/network_endpoint", include_str!("../../schemas/ocsf/v1.8.0/objects/network_endpoint.json")),
("v1.8.0/objects/network_proxy", include_str!("../../schemas/ocsf/v1.8.0/objects/network_proxy.json")),
("v1.8.0/objects/os", include_str!("../../schemas/ocsf/v1.8.0/objects/os.json")),
("v1.8.0/objects/process", include_str!("../../schemas/ocsf/v1.8.0/objects/process.json")),
("v1.8.0/objects/product", include_str!("../../schemas/ocsf/v1.8.0/objects/product.json")),
("v1.8.0/objects/remediation", include_str!("../../schemas/ocsf/v1.8.0/objects/remediation.json")),
("v1.8.0/objects/resource_details", include_str!("../../schemas/ocsf/v1.8.0/objects/resource_details.json")),
("v1.8.0/objects/service", include_str!("../../schemas/ocsf/v1.8.0/objects/service.json")),
("v1.8.0/objects/tactic", include_str!("../../schemas/ocsf/v1.8.0/objects/tactic.json")),
("v1.8.0/objects/technique", include_str!("../../schemas/ocsf/v1.8.0/objects/technique.json")),
("v1.8.0/objects/url", include_str!("../../schemas/ocsf/v1.8.0/objects/url.json")),
("v1.8.0/objects/user", include_str!("../../schemas/ocsf/v1.8.0/objects/user.json")),
("v1.8.0/profiles/ai_operation", include_str!("../../schemas/ocsf/v1.8.0/profiles/ai_operation.json")),
];
crates/openshell-ocsf/src/validation/mod.rs
+4 -1
View File
@@ -6,6 +6,9 @@
//! Available in this crate's tests or through the `test-support` feature for
//! producer regression tests.
mod embedded;
pub mod schema;
pub use schema::{load_class_schema, validate_enum_value, validate_required_fields};
pub use schema::{
load_class_schema, validate_enum_value, validate_known_fields, validate_required_fields,
};
crates/openshell-ocsf/src/validation/schema.rs
+357 -73
View File
@@ -4,7 +4,6 @@
//! Schema loading and validation helpers.
use serde_json::Value;
use std::fs;
/// Load a vendored OCSF class schema by name.
///
@@ -13,13 +12,7 @@ use std::fs;
/// Panics if the schema file is missing or contains invalid JSON.
#[must_use]
pub fn load_class_schema(class: &str) -> Value {
let path = format!(
"{}/schemas/ocsf/v1.8.0/classes/{class}.json",
env!("CARGO_MANIFEST_DIR")
);
let data =
fs::read_to_string(&path).unwrap_or_else(|_| panic!("Missing vendored schema: {path}"));
serde_json::from_str(&data).unwrap_or_else(|e| panic!("Invalid JSON in {path}: {e}"))
load_schema(crate::OCSF_VERSION, "classes", class)
}
/// Load a vendored OCSF object schema by name.
@@ -29,89 +22,194 @@ pub fn load_class_schema(class: &str) -> Value {
/// Panics if the schema file is missing or contains invalid JSON.
#[must_use]
pub fn load_object_schema(object: &str) -> Value {
let path = format!(
"{}/schemas/ocsf/v1.8.0/objects/{object}.json",
env!("CARGO_MANIFEST_DIR")
);
let data =
fs::read_to_string(&path).unwrap_or_else(|_| panic!("Missing vendored schema: {path}"));
serde_json::from_str(&data).unwrap_or_else(|e| panic!("Invalid JSON in {path}: {e}"))
load_schema(crate::OCSF_VERSION, "objects", object)
}
/// Validate that all required fields from the schema are present in the event JSON.
///
/// The OCSF schema stores attributes as an object where each key is a field name
/// and the value contains a `requirement` field.
pub fn validate_required_fields(event: &Value, schema: &Value) {
let attrs = match schema.get("attributes") {
Some(Value::Object(map)) => map
.iter()
.map(|(k, v)| (k.clone(), v.clone()))
.collect::<Vec<_>>(),
/// Schemas are compiled into the binary so that relocated test binaries, such
/// as a nextest archive run on another machine, need no files at run time.
fn load_schema(version: &str, kind: &str, name: &str) -> Value {
let key = format!("v{version}/{kind}/{name}");
let Some((_, data)) = super::embedded::SCHEMAS
.iter()
.find(|(path, _)| *path == key)
else {
panic!("Missing vendored schema: schemas/ocsf/{key}.json");
};
serde_json::from_str(data).unwrap_or_else(|e| panic!("Invalid JSON in {key}: {e}"))
}
/// Attribute definitions keyed by name; the schema server emits them as an
/// object or as an array of single-entry objects.
fn attribute_map(schema: &Value) -> serde_json::Map<String, Value> {
match schema.get("attributes") {
Some(Value::Object(map)) => map.clone(),
Some(Value::Array(arr)) => arr
.iter()
.filter_map(|item| item.as_object())
.filter_map(Value::as_object)
.flat_map(|obj| obj.iter().map(|(k, v)| (k.clone(), v.clone())))
.collect::<Vec<_>>(),
_ => return,
.collect(),
_ => serde_json::Map::new(),
}
}
/// Profiles that add an attribute, or `None` when the attribute is part of the
/// base class or object.
fn attribute_profiles(def: &Value) -> Option<Vec<&str>> {
match def.get("profiles").or_else(|| def.get("profile")) {
Some(Value::Array(names)) => Some(names.iter().filter_map(Value::as_str).collect()),
Some(Value::String(name)) => Some(vec![name.as_str()]),
_ => None,
}
}
fn declared_profiles(event: &Value) -> Vec<&str> {
event
.pointer("/metadata/profiles")
.and_then(Value::as_array)
.map(|p| p.iter().filter_map(Value::as_str).collect())
.unwrap_or_default()
}
/// Validate an OCSF event or object against a vendored schema.
///
/// Checks, recursively through nested objects: every required attribute is
/// present, `at_least_one` constraints hold, and no attribute is undefined.
/// For an event class schema the event must also be labelled with
/// [`crate::OCSF_VERSION`], profile attributes are required only when the event
/// declares that profile, and every profile attribute present must belong to a
/// declared profile. An object schema carries no profile declarations, so
/// profile membership is checked only from an event.
pub fn validate_required_fields(value: &Value, schema: &Value) {
validate(value, schema, true);
}
/// Validate that every attribute is defined by the schema, recursively.
///
/// For an event class schema, profile attributes must also belong to a profile
/// the event declares in `metadata.profiles` (none when absent).
pub fn validate_known_fields(value: &Value, schema: &Value) {
validate(value, schema, false);
}
fn validate(value: &Value, schema: &Value, check_required: bool) {
let is_event = schema.get("uid").is_some();
if is_event && let Some(version) = value.pointer("/metadata/version") {
assert!(
version == crate::OCSF_VERSION,
"OCSF records must be labelled {}, found {version}",
crate::OCSF_VERSION
);
}
let declared = is_event.then(|| declared_profiles(value));
let root = if is_event {
"event"
} else {
schema["name"].as_str().unwrap_or("object")
};
validate_attributes(
value,
schema,
declared.as_deref(),
root,
is_event,
check_required,
);
}
/// Top-level attributes `OpenShell` emits that no OCSF version defines, pending a
/// design decision. Remove an entry once the emitters stop producing it.
/// - `container`: identifies the affected sandbox (NVIDIA/OpenShell#4915).
const KNOWN_UNDEFINED_EVENT_ATTRIBUTES: &[&str] = &["container"];
fn validate_attributes(
value: &Value,
schema: &Value,
declared: Option<&[&str]>,
path: &str,
event_root: bool,
check_required: bool,
) {
let attrs = attribute_map(schema);
let Some(obj) = value.as_object() else {
return;
};
if let Some(fields) = schema
.get("constraints")
.and_then(|constraints| constraints.get("at_least_one"))
.and_then(Value::as_array)
if check_required
&& let Some(fields) = schema
.get("constraints")
.and_then(|constraints| constraints.get("at_least_one"))
.and_then(Value::as_array)
{
assert!(
fields
.iter()
.filter_map(Value::as_str)
.any(|field| { event.get(field).is_some_and(|value| !value.is_null()) }),
"Missing at_least_one field from {fields:?}"
.any(|field| { obj.get(field).is_some_and(|value| !value.is_null()) }),
"Missing at_least_one field from {fields:?} in '{path}'"
);
}
for name in obj.keys() {
if event_root && KNOWN_UNDEFINED_EVENT_ATTRIBUTES.contains(&name.as_str()) {
continue;
}
let Some(def) = attrs.get(name) else {
panic!("Undefined attribute '{path}.{name}'");
};
if let (Some(declared), Some(profiles)) = (declared, attribute_profiles(def)) {
assert!(
profiles.iter().any(|profile| declared.contains(profile)),
"Attribute '{path}.{name}' requires one of the profiles {profiles:?}, declared {declared:?}"
);
}
}
for (name, def) in &attrs {
let is_required = def.get("requirement").and_then(|r| r.as_str()) == Some("required");
let is_profile_field = def.get("profile").is_some() || def.get("profiles").is_some();
if is_required && !is_profile_field {
// An attribute added by profiles applies only when the event declares one of them.
let applies = attribute_profiles(def).is_none_or(|profiles| {
declared.is_some_and(|declared| profiles.iter().any(|p| declared.contains(p)))
});
if check_required && is_required && applies {
assert!(
event.get(name).is_some_and(|value| !value.is_null()),
"Missing required field '{name}' in OCSF event. Event keys: {:?}",
event.as_object().map(|o| o.keys().collect::<Vec<_>>())
obj.get(name).is_some_and(|value| !value.is_null()),
"Missing required field '{path}.{name}'. Keys: {:?}",
obj.keys().collect::<Vec<_>>()
);
}
}
}
/// Validate that every attribute in the event is defined by the schema and,
/// for event classes, that profile attributes belong to a profile the event
/// declares in `metadata.profiles` (none when absent).
pub fn validate_known_fields(event: &Value, schema: &Value) {
let Some(attrs) = schema.get("attributes").and_then(Value::as_object) else {
return;
};
let declared: Option<Vec<&str>> = schema.get("uid").map(|_| {
event
.pointer("/metadata/profiles")
.and_then(Value::as_array)
.map(|profiles| profiles.iter().filter_map(Value::as_str).collect())
.unwrap_or_default()
});
let schema_name = schema["name"].as_str().unwrap_or_default();
for name in event.as_object().into_iter().flat_map(|o| o.keys()) {
let Some(def) = attrs.get(name) else {
panic!("Field '{name}' is not defined by the '{schema_name}' schema");
let Some(object_type) = def.get("object_type").and_then(Value::as_str) else {
continue;
};
if let (Some(declared), Some(profiles)) =
(&declared, def.get("profiles").and_then(Value::as_array))
{
assert!(
profiles
.iter()
.filter_map(Value::as_str)
.any(|profile| declared.contains(&profile)),
"Field '{name}' requires one of the profiles {profiles:?}, declared {declared:?}"
);
let Some(child) = obj.get(name) else {
continue;
};
if object_type == "object" {
continue;
}
let child_schema = load_schema(crate::OCSF_VERSION, "objects", object_type);
let child_path = format!("{path}.{name}");
match child {
Value::Array(items) => {
for item in items {
validate_attributes(
item,
&child_schema,
declared,
&child_path,
false,
check_required,
);
}
}
other => validate_attributes(
other,
&child_schema,
declared,
&child_path,
false,
check_required,
),
}
}
}
@@ -147,7 +245,8 @@ mod tests {
] {
let schema = load_class_schema(class);
let mut event = serde_json::json!({
"class_uid": schema["uid"], "severity_id": 1, "metadata": {},
"class_uid": schema["uid"], "severity_id": 1,
"metadata": {"version": "1.8.0", "product": {"name": "OpenShell", "vendor_name": "NVIDIA"}},
"time": 12345, "type_uid": 0, "activity_id": 0, "category_uid": 4
});
assert!(
@@ -158,20 +257,205 @@ mod tests {
assert!(
std::panic::catch_unwind(|| validate_required_fields(&event, &schema)).is_err()
);
event[field] = serde_json::json!({});
event[field] = match field {
"http_request" => serde_json::json!({"http_method": "GET"}),
"http_response" => serde_json::json!({"code": 200}),
_ => serde_json::json!({"ip": "10.0.0.1"}),
};
validate_required_fields(&event, &schema);
event.as_object_mut().unwrap().remove(field);
}
}
}
fn minimal_base_event() -> Value {
serde_json::json!({
"class_uid": 0, "severity_id": 1, "metadata": {"version": "1.8.0", "product": {"name": "OpenShell", "vendor_name": "NVIDIA"}},
"time": 12345, "type_uid": 99, "activity_id": 99, "category_uid": 0
})
}
#[test]
fn rejects_missing_required_attributes_in_nested_objects() {
let schema = load_class_schema("base_event");
let mut event = minimal_base_event();
event["metadata"]["profiles"] = serde_json::json!(["host"]);
event["device"] = serde_json::json!({
"hostname": "h", "type_id": 99, "os": {"name": "Linux", "type_id": 200}
});
validate_required_fields(&event, &schema);
event["device"]["os"]
.as_object_mut()
.unwrap()
.remove("type_id");
assert!(std::panic::catch_unwind(|| validate_required_fields(&event, &schema)).is_err());
}
fn panic_message(result: std::thread::Result<()>) -> String {
let panic = result.expect_err("validation should fail");
panic
.downcast_ref::<String>()
.cloned()
.or_else(|| panic.downcast_ref::<&str>().map(ToString::to_string))
.unwrap_or_default()
}
#[test]
fn rejects_nested_attributes_of_undeclared_profiles() {
let schema = load_class_schema("base_event");
let mut event = minimal_base_event();
event["device"] = serde_json::json!({
"hostname": "h", "type_id": 99, "os": {"name": "Linux", "type_id": 200},
"container": {"name": "sandbox"}
});
event["metadata"]["profiles"] = serde_json::json!(["host", "container"]);
validate_required_fields(&event, &schema);
event["metadata"]["profiles"] = serde_json::json!(["host"]);
let message = panic_message(std::panic::catch_unwind(|| {
validate_required_fields(&event, &schema);
}));
assert!(message.contains("event.device.container"), "{message}");
assert!(message.contains("container"), "{message}");
}
#[test]
fn object_schemas_are_validated_as_objects_not_events() {
let device = load_object_schema("device");
// An object carries no `metadata.profiles`, so profile membership is
// not checked: only the event that contains it knows its profiles.
let value = serde_json::json!({
"hostname": "h", "type_id": 99, "os": {"name": "Linux", "type_id": 200},
"namespace_pid": 7
});
validate_required_fields(&value, &device);
// The top-level `container` exemption applies to events only, so an
// object whose schema does not define `container` rejects it.
let user = load_object_schema("user");
let value = serde_json::json!({"name": "u", "container": {"name": "sandbox"}});
let message = panic_message(std::panic::catch_unwind(|| {
validate_required_fields(&value, &user);
}));
assert!(message.contains("user.container"), "{message}");
}
#[test]
fn rejects_records_labelled_with_another_version() {
let schema = load_class_schema("base_event");
let mut event = minimal_base_event();
event["metadata"]["version"] = Value::from("1.1.0");
let message = panic_message(std::panic::catch_unwind(|| {
validate_required_fields(&event, &schema);
}));
assert!(message.contains("must be labelled 1.8.0"), "{message}");
assert!(message.contains("1.1.0"), "{message}");
}
#[test]
fn known_fields_rejects_undefined_attributes_in_nested_objects() {
let schema = load_class_schema("authentication");
let mut event = serde_json::json!({
"class_uid": 3002,
"metadata": {"profiles": []},
"user": {"name": "operator"}
});
validate_known_fields(&event, &schema);
event["user"]["bogus"] = Value::from(1);
let message = panic_message(std::panic::catch_unwind(|| {
validate_known_fields(&event, &schema);
}));
assert!(message.contains("user.bogus"), "{message}");
}
/// Table key for a schema path relative to `schemas/ocsf`, joined with `/` on
/// every platform so the generated table is the same on Windows and Unix.
fn embedded_schema_key(relative: &std::path::Path) -> String {
let joined = relative
.components()
.map(|component| component.as_os_str().to_string_lossy())
.collect::<Vec<_>>()
.join("/");
joined.trim_end_matches(".json").to_string()
}
#[test]
fn embedded_schema_keys_use_forward_slashes_on_every_platform() {
// `join` uses the native separator, so on Windows this path has backslashes.
let relative = std::path::Path::new("v1.8.0")
.join("classes")
.join("api_activity.json");
assert_eq!(
embedded_schema_key(&relative),
"v1.8.0/classes/api_activity"
);
}
/// Regenerate with `UPDATE_OCSF_EMBEDDED_SCHEMAS=1 cargo test -p openshell-ocsf embedded_schemas`.
#[test]
fn embedded_schemas_match_vendored_files() {
let root = concat!(env!("CARGO_MANIFEST_DIR"), "/schemas/ocsf");
// This compares source files, so it needs the build checkout. Relocated
// test binaries (such as a nextest archive) skip it; validation itself
// uses the embedded table and needs no source files.
if !std::path::Path::new(root).is_dir() {
eprintln!("skipping: source checkout not found at {root}");
return;
}
let mut files = Vec::new();
let mut dirs = vec![std::path::PathBuf::from(root)];
while let Some(dir) = dirs.pop() {
for entry in std::fs::read_dir(&dir).unwrap().flatten() {
let path = entry.path();
if path.is_dir() {
dirs.push(path);
} else if path.extension().is_some_and(|ext| ext == "json") {
files.push(embedded_schema_key(path.strip_prefix(root).unwrap()));
}
}
}
files.sort();
let mut expected = String::from(
"// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.\n\
// SPDX-License-Identifier: Apache-2.0\n\n\
//! Vendored OCSF schemas compiled into the binary.\n//!\n\
//! @generated from `schemas/ocsf/`. Do not edit; regenerate with\n\
//! `UPDATE_OCSF_EMBEDDED_SCHEMAS=1 cargo test -p openshell-ocsf embedded_schemas`.\n\n\
#[rustfmt::skip]\npub(super) static SCHEMAS: &[(&str, &str)] = &[\n",
);
for file in &files {
use std::fmt::Write as _;
writeln!(
expected,
" (\"{file}\", include_str!(\"../../schemas/ocsf/{file}.json\")),"
)
.unwrap();
}
expected.push_str("];\n");
let path = concat!(env!("CARGO_MANIFEST_DIR"), "/src/validation/embedded.rs");
if std::env::var_os("UPDATE_OCSF_EMBEDDED_SCHEMAS").is_some() {
std::fs::write(path, &expected).unwrap();
}
// Windows checkouts can convert the generated file to CRLF.
let actual = std::fs::read_to_string(path)
.unwrap_or_default()
.replace("\r\n", "\n");
assert!(
actual == expected,
"embedded.rs is out of date; rerun with UPDATE_OCSF_EMBEDDED_SCHEMAS=1"
);
}
#[test]
fn known_fields_rejects_attributes_outside_the_schema() {
let schema = load_class_schema("base_event");
let mut event = serde_json::json!({"class_uid": 0, "severity_id": 1});
validate_known_fields(&event, &schema);
event["is_src_dst_assignment_known"] = Value::Bool(true);
event["not_an_ocsf_attribute"] = Value::Bool(true);
assert!(std::panic::catch_unwind(|| validate_known_fields(&event, &schema)).is_err());
}
@@ -235,7 +519,7 @@ mod tests {
let event = serde_json::json!({
"class_uid": 0,
"severity_id": 1,
"metadata": {},
"metadata": {"version": "1.8.0", "product": {"name": "OpenShell", "vendor_name": "NVIDIA"}},
"time": 12345,
"type_uid": 99,
"activity_id": 99,
crates/openshell-ocsf/tests/roundtrip.rs
+1
View File
@@ -127,6 +127,7 @@ fn process_activity_round_trips() {
.with_cmd_line("python3 -m pytest")
.with_parent(Process::new("/bin/sh", 4701)),
)
.actor_process(Process::new("openshell-sandbox", 4700))
.launch_type(LaunchTypeId::Other)
.exit_code(0)
.severity(SeverityId::Informational)
crates/openshell-sandbox/src/delegated.rs
+1
View File
@@ -138,6 +138,7 @@ pub async fn spawn_workload(
.status(StatusId::Success)
.launch_type(LaunchTypeId::Spawn)
.process(OcsfProcess::new(program, i64::from(handle.pid())))
.actor_process(crate::process::ocsf_launcher_process())
.message(format!("Process started: pid={}", handle.pid()))
.build()
);
crates/openshell-sandbox/src/process.rs
+6
View File
@@ -66,6 +66,11 @@ impl ResolvedWorkspace {
}
}
/// The sandbox launcher as the acting process of the Process Activity events it emits.
pub(crate) fn ocsf_launcher_process() -> openshell_ocsf::Process {
openshell_ocsf::Process::new("openshell-sandbox", i64::from(std::process::id()))
}
#[cfg(target_os = "linux")]
pub(crate) fn prepare_child_sandbox(
policy: &SandboxPolicy,
@@ -889,6 +894,7 @@ impl ProcessHandle {
.activity(openshell_ocsf::ActivityId::Close)
.severity(openshell_ocsf::SeverityId::Medium)
.status(openshell_ocsf::StatusId::Failure)
.actor_process(ocsf_launcher_process())
.message(format!("Failed to send SIGTERM: {e}"))
.build()
);
crates/openshell-supervisor-network/src/policy_dns/mod.rs
+1
View File
@@ -488,6 +488,7 @@ fn dns_query_endpoint(name: &NormalizedName) -> Endpoint {
ip: None,
port: None,
name: None,
svc_name: None,
}
}
crates/openshell-supervisor-process/src/ssh.rs
+52 -1
View File
@@ -34,6 +34,12 @@ use std::time::Duration;
use tokio::net::UnixListener;
use tracing::warn;
/// OCSF destination endpoint for events about this supervisor's SSH server,
/// which listens on a Unix socket rather than a network address.
fn ssh_server_endpoint(listen_path: &Path) -> openshell_ocsf::Endpoint {
openshell_ocsf::Endpoint::local_service("ssh", Some(&listen_path.display().to_string()))
}
const NO_LOGIN_SHELL_ENV: (&str, &str) = ("OPENSHELL_NO_LOGIN_SHELL", "1");
const MAIN_DETACH_PREFIX: u8 = 0x10;
const MAIN_DETACH_KEY: u8 = 0x11;
@@ -146,6 +152,7 @@ fn ssh_server_init(
ocsf_emit!(
SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint(ssh_server_endpoint(listen_path))
.activity(ActivityId::Listen)
.severity(SeverityId::Informational)
.status(StatusId::Success)
@@ -183,6 +190,7 @@ pub async fn run_ssh_server(
}
};
let server_endpoint = Arc::new(ssh_server_endpoint(&listen_path));
let mut consecutive_resource_errors = 0;
let mut consecutive_unknown_errors = 0;
loop {
@@ -194,6 +202,7 @@ pub async fn run_ssh_server(
let port_forward = port_forward.clone();
let boundary_exec = boundary_exec.clone();
let main_session = main_session.clone();
let server_endpoint = server_endpoint.clone();
tokio::spawn(async move {
if let Err(err) = handle_connection(
@@ -202,12 +211,14 @@ pub async fn run_ssh_server(
port_forward,
boundary_exec,
main_session,
server_endpoint.clone(),
SSH_PEER_TIMEOUT,
)
.await
{
ocsf_emit!(
SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint((*server_endpoint).clone())
.activity(ActivityId::Fail)
.severity(SeverityId::Low)
.status(StatusId::Failure)
@@ -228,6 +239,7 @@ pub async fn run_ssh_server(
SshAcceptAction::Retry { backoff, severity } => {
ocsf_emit!(
SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint((*server_endpoint).clone())
.activity(ActivityId::Fail)
.severity(severity)
.status(StatusId::Failure)
@@ -343,6 +355,7 @@ async fn handle_connection(
port_forward: Arc<openshell_sandbox_backend::BoundaryLoopbackConnector>,
boundary_exec: Arc<openshell_sandbox_backend::BoundaryExec>,
main_session: Option<Arc<MainSession>>,
server_endpoint: Arc<openshell_ocsf::Endpoint>,
peer_timeout: Duration,
) -> Result<()> {
// Access is gated by the Unix-socket filesystem permissions (root-only),
@@ -350,6 +363,7 @@ async fn handle_connection(
// gateway's RelayStream directly into this socket.
ocsf_emit!(
SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint((*server_endpoint).clone())
.activity(ActivityId::Open)
.action(ActionId::Allowed)
.disposition(DispositionId::Allowed)
@@ -359,7 +373,7 @@ async fn handle_connection(
.build()
);
let handler = SshHandler::new(port_forward, boundary_exec, main_session);
let handler = SshHandler::new(port_forward, boundary_exec, main_session, server_endpoint);
let stream = peer_stream::PeerStream::new(stream, peer_timeout);
russh::server::run_stream(config, stream, handler)
.await
@@ -425,6 +439,8 @@ struct SshHandler {
port_forward: Arc<openshell_sandbox_backend::BoundaryLoopbackConnector>,
boundary_exec: Arc<openshell_sandbox_backend::BoundaryExec>,
main_session: Option<Arc<MainSession>>,
/// This server's endpoint, named on every SSH event it emits.
server_endpoint: Arc<openshell_ocsf::Endpoint>,
channels: HashMap<ChannelId, ChannelState>,
}
@@ -452,11 +468,13 @@ impl SshHandler {
port_forward: Arc<openshell_sandbox_backend::BoundaryLoopbackConnector>,
boundary_exec: Arc<openshell_sandbox_backend::BoundaryExec>,
main_session: Option<Arc<MainSession>>,
server_endpoint: Arc<openshell_ocsf::Endpoint>,
) -> Self {
Self {
port_forward,
boundary_exec,
main_session,
server_endpoint,
channels: HashMap::new(),
}
}
@@ -535,6 +553,7 @@ impl russh::server::Handler for SshHandler {
// check, port 65537 truncates to port 1 (privileged).
if port_to_connect > u32::from(u16::MAX) {
ocsf_emit!(SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint((*self.server_endpoint).clone())
.activity(ActivityId::Refuse)
.action(ActionId::Denied)
.disposition(DispositionId::Blocked)
@@ -552,6 +571,7 @@ impl russh::server::Handler for SshHandler {
let target = direct_tcpip_target(host_to_connect, port_to_connect);
if target.is_none() {
ocsf_emit!(SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint((*self.server_endpoint).clone())
.activity(ActivityId::Refuse)
.action(ActionId::Denied)
.disposition(DispositionId::Blocked)
@@ -572,6 +592,7 @@ impl russh::server::Handler for SshHandler {
let port = u16::try_from(port_to_connect).expect("port range checked above");
let target = target.expect("loopback target checked above");
let port_forward = self.port_forward.clone();
let server_endpoint = self.server_endpoint.clone();
reply.accept().await;
tokio::spawn(async move {
@@ -580,6 +601,7 @@ impl russh::server::Handler for SshHandler {
Err(err) => {
ocsf_emit!(
SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint((*server_endpoint).clone())
.activity(ActivityId::Fail)
.severity(SeverityId::Low)
.status(StatusId::Failure)
@@ -883,6 +905,7 @@ impl russh::server::Handler for SshHandler {
} else {
ocsf_emit!(
SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint((*self.server_endpoint).clone())
.activity(ActivityId::Refuse)
.action(ActionId::Denied)
.disposition(DispositionId::Rejected)
@@ -1541,6 +1564,28 @@ fn direct_tcpip_target(
mod tests {
use super::*;
#[test]
fn ssh_events_name_their_own_server_socket_and_conform_to_ocsf() {
use openshell_ocsf::validation::{load_class_schema, validate_required_fields};
// A shared supervisor runs one SSH server per sandbox; each server's
// events must name its own socket.
for socket in ["/run/openshell/a/ssh.sock", "/run/openshell/b/ssh.sock"] {
let event = SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
.dst_endpoint(ssh_server_endpoint(Path::new(socket)))
.activity(ActivityId::Open)
.action(ActionId::Allowed)
.message("SSH connection accepted on supervisor Unix socket")
.build();
let json = event.to_json().unwrap();
assert_eq!(
json["dst_endpoint"],
serde_json::json!({"name": socket, "svc_name": "ssh"})
);
validate_required_fields(&json, &load_class_schema("ssh_activity"));
}
}
pub(super) struct AcceptAnyServerKey;
struct PinnedServerKey(String);
@@ -1589,14 +1634,17 @@ mod tests {
let socket = temp.path().join("ssh.sock");
let (listener, config, _) =
ssh_server_init(&socket, &None, false, key.clone()).unwrap();
let server_endpoint = Arc::new(ssh_server_endpoint(&socket));
let server = tokio::spawn(async move {
while let Ok((stream, _)) = listener.accept().await {
let config = config.clone();
let server_endpoint = server_endpoint.clone();
tokio::spawn(async move {
let handler = SshHandler::new(
rpc_test::loopback(Arc::new(TestLoopbackConnector)),
rpc_test::exec(Arc::new(RejectingExec)),
None,
server_endpoint,
);
if let Ok(session) =
russh::server::run_stream(config, stream, handler).await
@@ -1733,6 +1781,9 @@ mod tests {
rpc_test::loopback(Arc::new(TestLoopbackConnector)),
boundary_exec,
main_session,
Arc::new(ssh_server_endpoint(Path::new(
"/run/openshell/test/ssh.sock",
))),
);
let (server_stream, client_stream) = tokio::io::duplex(64 * 1024);
tokio::spawn(async move {
crates/openshell-supervisor-process/src/ssh/reconnect_tests.rs
+2
View File
@@ -123,6 +123,7 @@ impl Connection {
// Preserve whether production enables probes. Only shorten the interval.
let config_mut = Arc::get_mut(&mut config).unwrap();
config_mut.keepalive_interval = config_mut.keepalive_interval.map(|_| TEST_INTERVAL);
let server_endpoint = Arc::new(ssh_server_endpoint(&socket));
let server_task = tokio::spawn(async move {
let (stream, _) = listener.accept().await.unwrap();
let _ = handle_connection(
@@ -131,6 +132,7 @@ impl Connection {
rpc_test::loopback(Arc::new(TestLoopbackConnector)),
rpc_test::exec(Arc::new(RejectingExec)),
Some(main),
server_endpoint,
TEST_INTERVAL * 4,
)
.await;
docs/observability/ocsf-json-export.mdx
+7 -1
View File
@@ -147,7 +147,13 @@ For gateway-produced records, `device.os.name` and `device.os.type_id` identify
`metadata.uid` uniquely identifies an event and stays unchanged when that record is serialized again. Use `container.uid` to associate the event with its sandbox, not `metadata.uid`. Records without a sandbox association omit the container; unknown images are omitted rather than represented by an empty image name.
Each JSONL file line, or the payload after the stderr marker, is a complete OCSF v1.8.0 JSON object when no downgrade is configured. Here is an example of a network connection event:
Some fields depend on the event class:
- SSH Activity records name the supervisor's SSH server as `dst_endpoint`, with `svc_name: "ssh"` and the listen socket path in `name`, because the server listens on a Unix socket rather than a network address.
- Process Activity records from the sandbox name the `openshell-sandbox` launcher as `actor.process`.
- `connection_info` carries `direction_id` and `direction`. OpenShell reports Unknown (`0`) where it does not track the direction.
Each JSONL file line, or the payload after the stderr marker, is a complete OCSF v1.8.0 JSON object when no downgrade is configured. Records validate against OCSF v1.8.0 except for the top-level `container` object, which OCSF does not define at the event level. Here is an example of a network connection event:
```json
{
e2e/rust/Cargo.lock
Generated
+1
View File
@@ -1848,6 +1848,7 @@ dependencies = [
"nix",
"noyalib",
"openshell-crypto",
"openshell-ocsf",
"openshell-otel-test-support",
"opentelemetry-proto",
"prost",
e2e/rust/Cargo.toml
+6
View File
@@ -134,6 +134,11 @@ name = "podman_host_gateway"
path = "tests/podman_host_gateway.rs"
required-features = ["e2e-podman"]
[[test]]
name = "ocsf_jsonl_conformance"
path = "tests/ocsf_jsonl_conformance.rs"
required-features = ["e2e-podman"]
[[test]]
name = "podman_corporate_proxy"
path = "tests/podman_corporate_proxy.rs"
@@ -297,6 +302,7 @@ url = "2"
nix = { version = "0.29", features = ["process", "signal", "term", "user"] }
[dev-dependencies]
openshell-ocsf = { path = "../../crates/openshell-ocsf", features = ["test-support"] }
serial_test = "3"
[lints.rust]
e2e/rust/e2e-podman.sh
+1
View File
@@ -37,6 +37,7 @@ PODMAN_CI_TESTS=(
live_policy_update
local_driver_token_restart
no_proxy
ocsf_jsonl_conformance
otlp_relay
podman_corporate_proxy
podman_gateway_start
e2e/rust/tests/ocsf_jsonl_conformance.rs
+279
View File
@@ -0,0 +1,279 @@
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0
//! Supervisor OCSF JSONL must validate against the native OCSF schema.
//!
//! Unit tests cover the builders; this covers what production call sites
//! actually write. Records are copied out of the Podman supervisor container,
//! whose `/var/log` is a tmpfs that `podman cp` can read while it runs.
#![cfg(feature = "e2e-podman")]
use std::io::Write;
use std::time::Duration;
use openshell_e2e::harness::cli::run_cli;
use openshell_e2e::harness::container::{ContainerEngine, ContainerHttpServer};
use openshell_e2e::harness::sandbox::SandboxGuard;
use openshell_ocsf::validation::{load_class_schema, validate_required_fields};
use serde_json::Value;
use tempfile::NamedTempFile;
/// Denied traffic: TCP to hosts the policy doesn't list (Network Activity)
/// and an HTTP request the L7 policy denies (HTTP Activity). 198.51.100.1 is
/// RFC 5737 TEST-NET-2 and never routes.
fn traffic(host: &str, port: u16) -> String {
format!(
r#"
import socket, urllib.request
for target in [("example.com", 80), ("example.com", 443), ("198.51.100.1", 80)]:
try:
socket.create_connection(target, timeout=5).close()
except OSError:
pass
try:
urllib.request.urlopen(urllib.request.Request("http://{host}:{port}/allowed", data=b"x", method="POST"), timeout=10)
except Exception:
pass
"#
)
}
const HTTP_SERVER: &str = r#"from http.server import BaseHTTPRequestHandler, HTTPServer
class Handler(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.end_headers()
def do_POST(self):
self.send_response(200)
self.end_headers()
def log_message(self, format, *args):
pass
HTTPServer(("0.0.0.0", 8000), Handler).serve_forever()
"#;
/// A policy whose only endpoint is the test server, with an L7 rule that
/// allows `GET /allowed`, so any other request is an HTTP Activity denial.
fn l7_policy(host: &str, port: u16) -> NamedTempFile {
let mut file = NamedTempFile::new().expect("temp policy file");
write!(
file,
r#"version: 1
filesystem_policy:
include_workdir: true
read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
read_write: [/sandbox, /tmp, /dev/null]
landlock:
compatibility: best_effort
process:
run_as_user: sandbox
run_as_group: sandbox
network_policies:
ocsf_l7:
name: ocsf_l7
endpoints:
- host: {host}
port: {port}
protocol: rest
enforcement: enforce
allowed_ips: ["10.0.0.0/8", "172.0.0.0/8", "192.168.0.0/16", "fc00::/7"]
rules:
- allow:
method: GET
path: /allowed
binaries:
- path: /usr/bin/python*
- path: /usr/local/bin/python*
- path: /sandbox/.uv/python/*/bin/python*
"#
)
.expect("write policy");
file
}
/// Classes the traffic must produce: Network, HTTP and SSH Activity (the
/// SSH session that runs the traffic).
const REQUIRED_CLASSES: [u64; 3] = [4001, 4002, 4007];
fn class_schema_name(class_uid: u64) -> Option<&'static str> {
Some(match class_uid {
0 => "base_event",
1007 => "process_activity",
2004 => "detection_finding",
3002 => "authentication",
4001 => "network_activity",
4002 => "http_activity",
4007 => "ssh_activity",
5019 => "device_config_state_change",
6002 => "application_lifecycle",
6003 => "api_activity",
_ => return None,
})
}
async fn set_sandbox_setting(sandbox: &str, key: &str, value: &str) {
let (output, code) =
run_cli(&["settings", "set", sandbox, "--key", key, "--value", value]).await;
assert_eq!(code, 0, "settings set {key}={value} failed:\n{output}");
}
fn missing_classes(records: &[Value]) -> Vec<u64> {
REQUIRED_CLASSES
.into_iter()
.filter(|class| !records.iter().any(|r| r["class_uid"] == *class))
.collect()
}
/// Copy the supervisor's OCSF JSONL records for `sandbox`, or say why not.
fn supervisor_records(engine: &ContainerEngine, sandbox: &str) -> Result<Vec<Value>, String> {
let filter = format!("label=openshell.ai/sandbox-name={sandbox}");
let ps = engine
.command()
.args([
"ps",
"--filter",
&filter,
"--format",
"{{index .Labels \"openshell.ai/sandbox-id\"}}",
])
.output()
.map_err(|e| format!("could not run ps: {e}"))?;
if !ps.status.success() {
return Err(format!(
"ps --filter {filter} failed: {}",
String::from_utf8_lossy(&ps.stderr)
));
}
let ids = String::from_utf8_lossy(&ps.stdout);
let id = ids
.lines()
.map(str::trim)
.find(|id| !id.is_empty())
.ok_or_else(|| format!("no container matches {filter}"))?;
let dir = tempfile::tempdir().map_err(|e| format!("temp dir: {e}"))?;
let source = format!("openshell-supervisor-{id}:/var/log/.");
let copied = engine
.command()
.args(["cp", &source, &dir.path().display().to_string()])
.output()
.map_err(|e| format!("could not run cp: {e}"))?;
if !copied.status.success() {
return Err(format!(
"cp {source} failed: {}",
String::from_utf8_lossy(&copied.stderr)
));
}
let mut records = Vec::new();
let mut files = Vec::new();
for entry in std::fs::read_dir(dir.path())
.map_err(|e| format!("read copied logs: {e}"))?
.flatten()
{
let name = entry.file_name().to_string_lossy().to_string();
if !name.starts_with("openshell-ocsf") {
continue;
}
let text =
std::fs::read_to_string(entry.path()).map_err(|e| format!("read {name}: {e}"))?;
// The supervisor may be mid-write when the file is copied; a final
// line without its newline is incomplete, not malformed.
let complete = text.rfind('\n').map_or("", |end| &text[..end]);
for line in complete.lines().filter(|line| !line.trim().is_empty()) {
records.push(
serde_json::from_str(line)
.map_err(|e| format!("{name}: invalid JSON line: {e}"))?,
);
}
files.push(name);
}
if files.is_empty() {
return Err(format!("no openshell-ocsf* files in {source}"));
}
Ok(records)
}
#[tokio::test]
async fn supervisor_jsonl_conforms_to_the_native_schema() {
let engine = ContainerEngine::from_env().expect("container engine");
let server = ContainerHttpServer::start_python("ocsf-l7.openshell.test", HTTP_SERVER)
.await
.expect("start test server");
let policy = l7_policy(&server.host, server.port);
let policy_path = policy.path().to_str().expect("UTF-8 policy path");
let mut guard = SandboxGuard::create_keep_with_args(
&["--policy", policy_path, "--no-tty"],
&["sh", "-c", "echo Ready && sleep infinity"],
"Ready",
)
.await
.expect("sandbox create");
let traffic = traffic(&server.host, server.port);
set_sandbox_setting(&guard.name, "ocsf_json_enabled", "true").await;
// Settings reach the supervisor on its next poll; generate traffic until
// every required class appears.
let mut records = Vec::new();
let mut last_error = None;
for _ in 0..12 {
let _ = guard.exec(&["python3", "-c", &traffic]).await;
tokio::time::sleep(Duration::from_secs(5)).await;
match supervisor_records(&engine, &guard.name) {
Ok(found) => {
records = found;
last_error = None;
if missing_classes(&records).is_empty() {
break;
}
}
Err(error) => last_error = Some(error),
}
}
guard.cleanup().await;
let missing = missing_classes(&records);
assert!(
missing.is_empty(),
"missing OCSF classes {missing:?} in {} records; last copy error: {}",
records.len(),
last_error.as_deref().unwrap_or("none")
);
let mut failures = Vec::new();
for record in &records {
assert_eq!(
record["metadata"]["version"],
openshell_ocsf::OCSF_VERSION,
"record labelled {}; native validation needs ocsf_schema_version unset \
for this sandbox and the gateway",
record["metadata"]["version"]
);
let class_uid = record["class_uid"].as_u64().expect("class_uid");
let Some(class) = class_schema_name(class_uid) else {
failures.push(format!(
"class_uid {class_uid} has no schema mapping in this test"
));
continue;
};
let schema = load_class_schema(class);
if let Err(panic) = std::panic::catch_unwind(|| validate_required_fields(record, &schema)) {
let reason = panic.downcast_ref::<String>().cloned().unwrap_or_default();
failures.push(format!(
"{} \"{}\": {reason}",
record["class_name"],
record["message"].as_str().unwrap_or_default()
));
}
}
assert!(
failures.is_empty(),
"non-conformant records:\n{}",
failures.join("\n")
);
}