search

gchq / event-logging-schema

Event Logging is an XML Schema for describing the auditable events generated by computer systems, hardware devices and access control systems
Apache License 2.0
25 stars 6 forks source link

Recording linking of events or events that form part of a session needs improving #58

Closed at055612 closed 3 years ago

at055612 commented 4 years ago

Following discussions on slack it was agreed that the way we model events that are part of some hierarchy, e.g. one event is the child of another, or events that form part of a session needs improving.

The proposed solution is 

  <EventSource>
    <EventId>abcdefg</EventId> <!-- A unique id known to the source system that created the event -->
    <SessionId>JSESSION12345</SessionId> <!-- A session id if the event was created as part of a session (can be used to associate events by session) -->
  </EventSource>
  <EventDetail>
    <!-- leave alone -->
  </EventDetail>
  <EventParent> <!-- Can we change EventChain to EventParent - might be more obvious unless we think we are describing sibling rather than parent child relationships? -->
     <EventId>12344</EventId> <!-- the Id (EventSource/EventId) from the parent event -->
     <EventParent>
        <EventId>12343</EventId> <!-- the Id (EventSource/EventId)from the parent of the parent event -->
      </EventParent>
  </EventParent>
</Event>

EventParent would replace EventChain