Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Metaschema: support event class and object attribute observables #993

Merged
merged 3 commits into from
Apr 3, 2024

Conversation

rmouritzen-splunk
Copy link
Contributor

@rmouritzen-splunk rmouritzen-splunk commented Mar 21, 2024

Related Issue:

Description of changes:

Metaschema changes.

  • Add class and object attribute observables.
  • Remove hard-coded list of categories from metaschema/categories.schema.json, leaving this to the ocsf-validator. This change makes testing with alternate schemas that may add extra categories easier, as well as making it possible to validate private extensions that contain new categories.
  • Detect unexpected top-level properties in object and event class definitions. This was added at this point to detect invalid observable definitions: invalid top-level observable property in event classes, and invalid top-level observables property in objects.

…e hard-coded list of categories from metadata/categories.schema.json, leaving this to the ocsf-validator. This change makes testing with alternate schemas that may add extra categories easier. It also makes it possible to validate private extensions that contain new categories.
…lasses, and detect invalid "observables" property in objects.

Update CHANGELOG.md with metaschema changes and improvements
Copy link
Contributor

@query-jeremy query-jeremy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I like how you've refactored common properties to common-event-object.schema.json.

Copy link
Contributor

@zschmerber zschmerber left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@dkolbly dkolbly left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@rmouritzen-splunk rmouritzen-splunk merged commit 3db07fe into ocsf:main Apr 3, 2024
2 checks passed
@rmouritzen-splunk rmouritzen-splunk deleted the observables branch April 3, 2024 17:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request non_breaking Non Breaking, backwards compatible changes v1.2.0 Changes marked for version v1.2.0 of OCSF
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants