You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
According to the 1.1.0 schema, incident_finding's priority should be an integer. This changed in later versions but https://schema.ocsf.io/1.1.0/sample/classes/incident_finding returns strings as if it were later versions.
The same problem occurs with the distributor field.
$ curl https://schema.ocsf.io/1.1.0/sample/classes/incident_finding &>/dev/null | jq .priority
"jack"
$ curl https://schema.ocsf.io/1.1.0/sample/classes/incident_finding &>/dev/null | jq .priority
"High"# the 1.1.0 schema
$ curl https://schema.ocsf.io/1.1.0/api/classes/incident_finding &>/dev/null | bb '(as-> (json/decode (slurp *in*)) % (get % "attributes") (apply merge %) (select-keys % ["priority"]) (println (json/encode % {:pretty true})))'
{
"priority": {
"type":"integer_t",
"description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.",
"group":"context",
"requirement":"optional",
"_source":"incident_finding",
"caption":"Priority",
"type_name":"Integer"
}
}
# changed to string in 1.2.0
$ curl https://schema.ocsf.io/1.2.0/api/classes/incident_finding &>/dev/null | bb '(as-> (json/decode (slurp *in*)) % (get % "attributes") (apply merge %) (select-keys % ["priority"]) (println (json/encode % {:pretty true})))'
{
"priority": {
"type":"string_t",
"description":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source.",
"group":"context",
"requirement":"optional",
"_source":"incident_finding",
"caption":"Priority",
"type_name":"String"
}
}
The text was updated successfully, but these errors were encountered:
According to the 1.1.0 schema,
incident_finding
'spriority
should be an integer. This changed in later versions buthttps://schema.ocsf.io/1.1.0/sample/classes/incident_finding
returns strings as if it were later versions.The same problem occurs with the
distributor
field.The text was updated successfully, but these errors were encountered: