Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Zone to managed entity object #1181

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

max-power15
Copy link
Contributor

@max-power15 max-power15 commented Sep 25, 2024

Related Issue:

Managed Entity object was did not stand out as an obvious choice when reviewing Okta Network zones.

Description of changes:

  • Following a discussion based on Okta system logs in slack, Network zones were considered to be an entity based on the operations performed.
  • Adding a Zone entity to the managed entity type_id enum.
  • Adding a Zone object

Signed-off-by: Martin McCloskey <[email protected]>
Signed-off-by: Martin McCloskey <[email protected]>
Signed-off-by: Martin McCloskey <[email protected]>
@max-power15 max-power15 changed the title Martin.mccloskey/add zone entity Add Zone to managed entity object Sep 25, 2024
Signed-off-by: Martin McCloskey <[email protected]>
@zschmerber
Copy link
Contributor

After looking at a zone.update log in Okta, i seems like the structure of the data my need to be carried by an array, also I see a zone https://schema.ocsf.io/1.3.0/objects/device?extensions= field in the schema so we would have a collision with adding a new object with the same name.

@mikeradka
Copy link
Contributor

Nice draft, @max-power15. I believe adding a Zone entity to the Entity Management class makes a lot of sense. However, there are a few logistics to consider:

  1. OCSF already includes a zone attribute, which is currently of type String. Changing its type to a zone object would be a breaking change.

  2. That said, I do see potential in creating an object which represents a zone (or even an array of zones), as it could include attributes like name and uid, and perhaps additional ones such as a CIDR range. One option could be to introduce a zone_info object or attribute. While the name is flexible, we would need to choose something other than zone to avoid breaking changes.

  3. If we proceed with a new zone_info object (or whatever the name may be), we might consider deprecating the current zone (String) attribute and directing to using the new object.

  4. This could also tie in with the recent discussions around a Network profile. I’d love to hear your thoughts, along with @pagbabian-splunk @floydtree @zschmerber @Aniak5

@max-power15
Copy link
Contributor Author

max-power15 commented Sep 26, 2024

@zschmerber @mikeradka

Great feedback, I wasn't aware of the zone attribute. Happy to adjust the object name and the additional attribute for CIDR

Is there a PR for the network profile I could check out, or is it being discussed in slack?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants