Merge pull request #6 from brandikuritz/authn-factor-obj

removed factor prefixes, security question to an array, changelog msg
ocsf · Feb 14, 2024 · 93e25c2 · 93e25c2
2 parents 0511662 + dd65f85
commit 93e25c2
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 44 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,6 +13,14 @@ Thankyou! -->
 
 ## [Unreleased]
 
+### Added 
+* #### Objects
+  1. Added `auth_factor` object. #949
+
+### Improved
+* #### Event Classes
+  1. Added `auth_factors` array to Authentication event class. #949
+
 <!-- All available sections in the Changelog:
 
 ### Added

diff --git a/dictionary.json b/dictionary.json
@@ -9,6 +9,12 @@
       "is_array": true,
       "type": "string_t"
     },
+    "auth_factors": {
+      "caption": "Authentication Factors",
+      "description": "Describes a category of methods used for identity verification in an authentication attempt.",
+      "is_array": true,
+      "type": "auth_factor"
+    },
     "access_mask": {
       "caption": "Access Mask",
       "description": "The access mask in a platform-native format.",
@@ -204,12 +210,6 @@
       "description": "The bitmask value that represents the file attributes.",
       "type": "integer_t"
     },
-    "auth_factors": {
-      "caption": "Authentication Factors",
-      "description": "Describes a category of methods used for identity verification in an authentication attempt.",
-      "is_array": true,
-      "type": "auth_factor"
-    },
     "auth_protocol": {
       "caption": "Auth Protocol",
       "description": "The authentication protocol as defined by the caption of 'auth_protocol_id'. In the case of 'Other', it is defined by the event source.",
@@ -1544,31 +1544,6 @@
       "is_array": true,
       "type": "tls_extension"
     },
-    "factor_device": {
-      "caption": "Factor Device",
-      "description": "Device used to complete an authentication request.",
-      "type": "device"
-    },
-    "factor_email": {
-      "caption": "Factor Email",
-      "description": "The email address used in an email-based authentication factor.",
-      "type": "email_t"
-    },
-    "factor_provider": {
-      "caption": "Factor Provider",
-      "description": "The name of provider for an authentication factor.",
-      "type": "string_t"
-    },
-    "factor_question": {
-      "caption": "Factor Question",
-      "description": "The question provided to user for a question-based authentication factor.",
-      "type": "string_t"
-    },
-    "factor_telephony_number": {
-      "caption": "Factor Telephony Number",
-      "description": "The phone number used for a telephony-based authentication request.",
-      "type": "string_t"
-    },
     "factor_type": {
       "caption": "Factor Type",
       "description": "The type of authentication factor used in an authentication attempt.",
@@ -2120,7 +2095,7 @@
       "description": "The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update.",
       "is_array": true,
       "type": "string_t"
-    },    
+    },
     "kb_article_list": {
       "caption": "Knowledgebase Articles",
       "description": "A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update.",
@@ -2748,6 +2723,11 @@
       "type": "integer_t",
       "sibling": "phase"
     },
+    "phone_number": {
+        "caption": "Phone Number",
+        "description": "The number associated with the phone.",
+        "type": "string_t"
+    },
     "phones": {
       "caption": "Phones",
       "description": "The phone numbers associated with the user",
@@ -3328,6 +3308,12 @@
       "description": "The object security descriptor.",
       "type": "string_t"
     },
+    "security_questions": {
+        "caption": "Security Questions",
+        "description": "The question(s) provided to user for a question-based authentication factor.",
+        "is_array": true,
+        "type": "string_t"
+    },
     "sequence": {
       "caption": "Sequence Number",
       "description": "Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.",
@@ -4190,4 +4176,4 @@
       }
     }
   }
-}
+}
diff --git a/objects/auth_factor.json b/objects/auth_factor.json
@@ -4,10 +4,6 @@
   "name": "auth_factor",
   "extends": "object",
   "attributes": {
-    "factor_device": {
-      "requirement": "recommended",
-      "group": "primary"
-    },
     "factor_type": {
       "requirement": "recommended",
       "group": "primary"
@@ -16,7 +12,13 @@
       "requirement": "required",
       "group": "primary"
     },
-    "factor_provider": {
+    "device": {
+      "description": "Device used to complete an authentication request.",
+      "requirement": "recommended",
+      "group": "primary"
+    },
+    "provider": {
+      "description": "The name of provider for an authentication factor.",
       "requirement": "recommended",
       "group": "context"
     },
@@ -28,24 +30,26 @@
       "requirement": "recommended",
       "group": "context"
     },
-    "factor_question": {
+    "security_questions": {
       "requirement": "optional",
       "group": "context"
     },
-    "factor_telephony_number": {
+    "phone_number": {
+      "description": "The phone number used for a telephony-based authentication request.",
       "requirement": "optional",
       "group": "context"
     },
-    "factor_email": {
+    "email_addr": {
+      "description": "The email address used in an email-based authentication factor.",
       "requirement": "optional",
       "group": "context"
     }
   },
   "constraints": {
     "just_one": [
-      "factor_email",
-      "factor_telephony_number",
-      "factor_question"
+      "email_addr",
+      "phone_number",
+      "security_questions"
     ]
   }
 }