search

ocsf / ocsf-schema

OCSF Schema
Apache License 2.0
631 stars 135 forks source link

Network Interface object should have an array of IPs, not just singleton #700

Open sfriedfertig opened 1 year ago

sfriedfertig commented 1 year ago

A Network Interface device (which should be represented in a single Network Interface object) can have multiple IPs mapped to a single MAC (even if it's just an IPv4 and an IPv6, but can also have multiple IPs in the same version, as has been seen in our own logs). Since the current Network Interface object has a single IP and a single MAC per object, the schema would force a developer to represent a single Network Interface device via multiple Network Interface objects. To solve this problem, the ip attribute should be changed to an array in the Network Interface object.

jasonbreimer commented 5 months ago

What about an array profile? A way to add an array to any value type? Or other way to apply array's to lots of things. Perhaps in 2.0.