search

ocsf / ocsf-schema

OCSF Schema
Apache License 2.0
582 stars 118 forks source link

Two Discovery classes have very similar names, one has a bad description. #933

Open pagbabian-splunk opened 5 months ago

pagbabian-splunk commented 5 months ago

The User Inventory Info class and the User Info class have names that are too similar and will be confusing as to which one to use for what purpose.

The description for the User Inventory Info class is only an example: no actual description for the class, which makes the confusion worse: "For example, this can be utilized to collect user information by gathering Active Directory data." The description was changed with PR #847.

The description for User Info tries to make it clear: "User Info events report user data that have been discovered, queried, polled or searched. This event differs from User Inventory as it describes the result of a targeted search by filtering a subset of user attributes."

The problem is that each class is consistent with some sister classes in the category: User Info with a slew of classes, and User Inventory Info with Device Inventory Info.

alanisaac commented 4 months ago

@pagbabian-splunk, is this closed by #942 ?