Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Observables Description and type_id change #891

Closed
zschmerber opened this issue Dec 12, 2023 · 2 comments
Closed

Observables Description and type_id change #891

zschmerber opened this issue Dec 12, 2023 · 2 comments
Assignees
Labels
description_updates Issues related to missing/incorrect/lacking descriptions of attributes enhancement New feature or request v1.2.0 Changes marked for version v1.2.0 of OCSF

Comments

@zschmerber
Copy link
Contributor

zschmerber commented Dec 12, 2023

1.) It seems like Observable "type": "File Hash", "type_id": 8 should be changed to just "Hash". We want to represent all fingerprint hashes in the observable. (see below image)

hash

This change would require a change to the observable Description.
image

2.) Each of the below Observables could be better served as a lower #. currently the values do not have representation in observables 1-10.
"type": "Geo Location", "type_id": 26 (value = location.coordinates)
"type": "Registry Key", "type_id": 28(value = reg_key.name)
"type": "Registry Value", "type_id": 29 (value = reg_value.name)
"type": "Container", "type_id": 27 (value = container.name)

@zschmerber zschmerber added enhancement New feature or request description_updates Issues related to missing/incorrect/lacking descriptions of attributes labels Dec 12, 2023
@zschmerber zschmerber self-assigned this Dec 12, 2023
@floydtree
Copy link
Contributor

As discussed, Part 1 should be good for 1.1.0 and is merged. For Part 2, we'll need to create new data types and will require more deliberation, considering the timeline, we can take up part 2 for a future release.

@floydtree floydtree added the v1.2.0 Changes marked for version v1.2.0 of OCSF label Jan 2, 2024
@rmouritzen-splunk
Copy link
Contributor

Looks like this was addressed. The file_hash_t type currently has a caption of "Hash". I was "File Hash" before this, matching the type. Seems like file_hash_t should have been called hash_t, but of course that would be a breaking change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
description_updates Issues related to missing/incorrect/lacking descriptions of attributes enhancement New feature or request v1.2.0 Changes marked for version v1.2.0 of OCSF
Projects
None yet
Development

No branches or pull requests

3 participants