From 5a8a358b3c05c4a380ad140dd603116a95cc58ca Mon Sep 17 00:00:00 2001
From: Rajas Panat <rajaspa@amazon.com>
Date: Tue, 10 Sep 2024 14:01:52 -0400
Subject: [PATCH] updating data type constraints

Signed-off-by: Rajas Panat <rajaspa@amazon.com>
---
 dictionary.json | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/dictionary.json b/dictionary.json
index 7757c7378..02f7ed288 100644
--- a/dictionary.json
+++ b/dictionary.json
@@ -4838,7 +4838,7 @@
   },
   "types": {
     "caption": "Data Types",
-    "description": "The predefined data types. The data type specifies what kind of data a value can have.",
+    "description": "The data types available in OCSF. Each data type specifies constraints in the form regular expressions, max lengths or value limits. Implementors of OCSF should ensure they abide to these constraints.",
     "attributes": {
       "boolean_t": {
         "caption": "Boolean",
@@ -4856,8 +4856,8 @@
       },
       "datetime_t": {
         "caption": "Datetime",
-        "description": "The Internet Date/Time format as defined in <a target='_blank' href='https://www.rfc-editor.org/rfc/rfc3339.html'>RFC-3339</a>. For example <code>1985-04-12T23:20:50.52Z</code>.",
-        "regex": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(Z|[\\+-]\\d{2}:\\d{2})?$",
+        "description": "The Internet Date/Time format as defined in <a target='_blank' href='https://www.rfc-editor.org/rfc/rfc3339.html'>RFC-3339</a>. For example:<br> <code>2024-09-10T23:20:50.520Z</code>,<br> <code>2024-09-10 23:20:50.520789Z</code>.",
+        "regex": "^\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(Z|[\\+-]\\d{2}:\\d{2})?$",
         "type": "string_t",
         "type_name": "String"
       },
@@ -4870,7 +4870,6 @@
         "type_name": "String"
       },
       "file_hash_t": {
-        "max_len": 64,
         "observable": 8,
         "caption": "Hash",
         "description": "Hash. A unique value that corresponds to the content of the file, image, ja3_hash or hassh found in the schema. For example MD5: <code>3172ac7e2b55cbb81f04a6e65855a628</code>.",
@@ -4945,7 +4944,6 @@
         "type_name": "String"
       },
       "resource_uid_t": {
-        "max_len": 64,
         "observable": 10,
         "caption": "Resource UID",
         "description": "Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID.",
@@ -4953,7 +4951,6 @@
         "type_name": "String"
       },
       "string_t": {
-        "max_len": 65535,
         "caption": "String",
         "description": "UTF-8 encoded byte sequence."
       },