User object should include an Enabled / Disabled state.

ocsf / ocsf-schema

OCSF Schema

Apache License 2.0

617 stars 130 forks source link

User object should include an Enabled / Disabled state. #1106

Open pagbabian-splunk opened 4 months ago

pagbabian-splunk commented 4 months ago

Jason from Microsoft brought this up as part of the discussion around PR #1076 re: standard state values.

If we decide to add Enabled and Disabled as standard (dictionary defined) state_id enums that today are just 0 / 99, it can be applied to User and other objects whose state may be enabled or disabled after an operation or during a discovery.

jonrau-at-queryai commented 4 months ago

+1. Perhaps this is better as an is_enabled or is_disabled bool longer term.

Snowflake, Crowdstrike, SentinelOne, and others have this tracked per-User but also per-Device in some cases.