krishicks
af6604a617
* feat(ocsf): add JSON Schema validator for OCSF events Add openshell-ocsf-validate, which validates an OCSF event against the JSON Schema the OCSF schema server exports for the event's version, class, and declared profiles. The exports encode required attributes, at_least_one constraints, undefined attributes, types, and enum values, so the crate delegates to the jsonschema crate and only selects the schema. The exports type type_uid only as an integer, so the crate also checks that it equals class_uid * 100 + activity_id. An exported schema covers one fixed set of profiles, so the crate vendors one export per class and profile combination that OpenShell emits, under schemas/v<version>/<class>@<profiles>.json. An event whose version or combination has no vendored schema fails with the schemas/update.sh command that vendors it. Keying on the event's version lets a new OCSF version's schemas land before the emitters switch to it. The build embeds every vendored file. Top-level container is accepted unvalidated, as OCSF does not define it at the event level (#4915). Signed-off-by: Kris Hicks <khicks@nvidia.com> * test(ocsf): validate OCSF events with openshell-ocsf-validate Replace openshell-ocsf's hand-written schema walker with openshell-ocsf-validate in the builder, producer, gateway audit and Podman e2e tests. One validate_event call now covers what the per-object validate_required_fields, validate_known_fields and validate_enum_value calls checked, and adds type checks and enum checks for every attribute. Remove the validation module and the vendored OCSF object and class schemas from openshell-ocsf. The e2e suite no longer depends on openshell-ocsf directly. Signed-off-by: Kris Hicks <khicks@nvidia.com> --------- Signed-off-by: Kris Hicks <khicks@nvidia.com>
openshell-ocsf-validate
Validates OCSF events against JSON Schemas exported by the OCSF schema server.
OCSF validity depends on the profiles an event declares in metadata.profiles, and an exported JSON Schema covers one fixed set of profiles. schemas/v<version>/ therefore holds one schema per event class and profile combination, named <class>@<profile>+<profile>.json with profiles sorted. validate_event picks the schema from the event's metadata.version, class_uid, and declared profiles, and fails when none is vendored.
The schemas check required attributes, at_least_one constraints, undefined attributes, types, and enum values, including the class and category identifiers. The schemas type type_uid only as an integer, so validate_event also checks that it equals class_uid * 100 + activity_id. The top-level container object is accepted although OCSF does not define it at the event level (NVIDIA/OpenShell#4915).
Updating
When a test validates an event whose version, class, and profile combination has no vendored schema, the error prints the command that vendors it. Run it from the repository root and commit the new file:
crates/openshell-ocsf-validate/schemas/update.sh crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@host+network_proxy+security_control.json
Without arguments, schemas/update.sh refetches every vendored schema. The schema server takes up to a few minutes per export. The build embeds every file under schemas/v*/, so tests need no source checkout at run time.
Changing OCSF versions
Each version's schemas live in their own directory, so a version change can land in steps:
- Run
schemas/update.shwith the current version's file names underschemas/v<new>/. Events labelled with the current version still validate against its schemas. - Change
openshell_ocsf::OCSF_VERSION. Events now validate against the new schemas. - Delete the old version's directory.