Observables Description and type_id change #891
Labels
description_updates
Issues related to missing/incorrect/lacking descriptions of attributes
enhancement
New feature or request
v1.2.0
Changes marked for version v1.2.0 of OCSF
1.) It seems like Observable
"type": "File Hash", "type_id": 8
should be changed to just "Hash". We want to represent all fingerprint hashes in the observable. (see below image)This change would require a change to the observable Description.
![image](https://private-user-images.githubusercontent.com/13574947/290269455-61db7960-d91c-4952-8d1d-e2a8287ff83a.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3Mzk0OTg1NjEsIm5iZiI6MTczOTQ5ODI2MSwicGF0aCI6Ii8xMzU3NDk0Ny8yOTAyNjk0NTUtNjFkYjc5NjAtZDkxYy00OTUyLThkMWQtZTJhODI4N2ZmODNhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTAyMTQlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUwMjE0VDAxNTc0MVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTM5NDkzODdjNGRlYzZlY2IwZDA2MGZlNDM4MzhjMjI4MzljODI2OTMzM2E5YTY3MDFiOTdkM2E0YjAwMzQ4YjkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.ePl319Dg-_ND_JyntLFlrmmGBJbgMGpb78e6fqihS-A)
2.) Each of the below Observables could be better served as a lower #. currently the values do not have representation in observables 1-10.
"type": "Geo Location", "type_id": 26
(value = location.coordinates)"type": "Registry Key", "type_id": 28
(value = reg_key.name)"type": "Registry Value", "type_id": 29
(value = reg_value.name)"type": "Container", "type_id": 27
(value = container.name)The text was updated successfully, but these errors were encountered: