ocsf / ocsf-server

OCSF Schema WEB Server
https://schema.ocsf.io/
Apache License 2.0
41 stars 28 forks source link

Excessive warnings during startup against existing 1.2.0 OCSF #88

Closed dkolbly closed 6 months ago

dkolbly commented 6 months ago

One of the PR guidelines for ocsf-schema is for this server to run without warnings. However, it is rather noisy when running against the current OCSF repo. These are the warnings from the v1.2.0 branch:

23:40:48.984 [warning] resource_details uses 'cloud' profile, but it does not define 'cloud' attribute
23:40:48.989 [warning] The invoked_by attribute in actor has been deprecated. Use <code> app_name, app_uid </code> attributes instead.
23:40:48.989 [warning] The finding object has been deprecated. Use the new <code>finding_info</code> object.
23:40:48.989 [warning] The type attribute in related_event has been deprecated. Use <code>type_name</code> attribute instead.
23:40:48.990 [warning] The related_analytics attribute in analytic has been deprecated. Related Analytics has been decoupled from this object, instead use <code>finding_info.related_analytics</code>.
23:40:48.990 [warning] The security_finding class has been deprecated. Use the new specific classes according to the use-case: <code>Vulnerability Finding, Compliance Finding, Detection Finding, Incident Finding.</code>
23:40:48.991 [warning] The web_resource_access_activity class has been deprecated. Use the <code>Web Resources Activity</code> class with the <code>Security Control</code> and/or <code>Network Proxy</code> profile instead.
23:40:48.992 [warning] The network_file_activity class has been deprecated. Use the new class: <code>'File Hosting Activity' in the 'Application'  category.</code>
23:40:48.993 [warning] The following attributes do not have a "requirement" field, a value of "optional" will be used: authentication.logon_process (class), authorization.decision (object), authorization.policy (object), device.uid_alt (object), device_config_state_change.prev_security_level (class), device_config_state_change.prev_security_level_id (class), device_config_state_change.prev_security_states (class), device_config_state_change.security_level (class), device_config_state_change.security_level_id (class), device_config_state_change.security_states (class), dhcp_activity.tls (class), dns_activity.tls (class), dns_answer.flag_ids (object), dns_answer.flags (object), email.subject (object), ftp_activity.tls (class), http_activity.http_status (class), http_activity.tls (class), http_request.http_method (object), logger.logged_time (object), memory_activity.size (class), metadata.loggers (object), network_activity.tls (class), network_connection_info.boundary (object), network_connection_info.boundary_id (object), network_connection_info.protocol_name (object), network_connection_info.protocol_ver (object), network_connection_info.protocol_ver_id (object), network_connection_info.tcp_flags (object), network_connection_info.uid (object), network_file_activity.tls (class), ntp_activity.tls (class), policy.is_applied (object), product.feature (object), product.path (object), product.url_string (object), rdp_activity.tls (class), security_state.state (object), security_state.state_id (object), smb_activity.tls (class), ssh_activity.tls (class), tunnel_activity.tls (class), url.categories (object), url.resource_type (object), win/win_resource.details (object), win/win_resource.svc_name (object)
floydtree commented 6 months ago

Agree, the solution to this is two fold,

  1. An ocsf-server PR to change remove warnings for deprecated entities (I don't see a value of such warnings while building a server, this should be more of a schema-presentation warning, which we already do using simple UI elements) & to remove profile related warnings, as it is an accepted and expected profile behavior.
  2. An ocsf-schema PR to fix missing requirement attributes to the schema definition files.
floydtree commented 6 months ago

Both the server and schema changes are now in, all the non-applicable warnings during a server run should now be gone after these changes.