Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add url attribute to file object #1291

Open
rmouritzen-splunk opened this issue Dec 18, 2024 · 1 comment
Open

Add url attribute to file object #1291

rmouritzen-splunk opened this issue Dec 18, 2024 · 1 comment
Assignees
@rmouritzen-splunk
Labels
enhancement New feature or request non_breaking Non Breaking, backwards compatible changes v1.4.0 or later Changes marked for versions beyond v1.3.0 of OCSF

Comments

@rmouritzen-splunk
Copy link
Contributor

Summary

Add url as an optional attribute in the file object.

Reasoning

The File Hosting Activity (6006) event class has no place to capture the URL of a file.

@zschmerber Hit this while creating OCSF events for Slack message that may include a file by URL in Network File Activity (4010 -- deprecated in favor of File Hosting Activity).

Email Activity (4009) has a similar issue.

We now have 2 (or more) situations where a url attribute inside the file object so it seems clear this is where the URL for File Hosting Activity should belong.

cc: @mikeradka
@rmouritzen-splunk rmouritzen-splunk changed the title Add url attribute to file object Add url attribute to file object Dec 18, 2024
@rmouritzen-splunk rmouritzen-splunk self-assigned this Dec 18, 2024
@mikeradka
Copy link
Contributor

Some extra context - we discussed this a bit in the 12/18/2024 system call and the group concluded that adding a url attribute to the file object would be a valuable addition.

@rmouritzen-splunk rmouritzen-splunk added enhancement New feature or request non_breaking Non Breaking, backwards compatible changes v1.4.0 or later Changes marked for versions beyond v1.3.0 of OCSF labels Dec 18, 2024
rmouritzen-splunk added a commit to rmouritzen-splunk/ocsf-schema that referenced this issue Dec 23, 2024
@rmouritzen-splunk
Issue ocsf#1291: Add url attribute to file object
6ba58bf
@rmouritzen-splunk rmouritzen-splunk mentioned this issue Dec 23, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rmouritzen-splunk rmouritzen-splunk

Labels
enhancement New feature or request non_breaking Non Breaking, backwards compatible changes v1.4.0 or later Changes marked for versions beyond v1.3.0 of OCSF
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@mikeradka @rmouritzen-splunk