ocsf / ocsf-validator

OCSF Schema Validation
Apache License 2.0
9 stars 5 forks source link

Fixed metaschema validation #13

Closed alanisaac closed 8 months ago

alanisaac commented 8 months ago

This PR fixes the logic for metaschema validation, so that it properly uses the Reader's definition of the loaded JSON (via contents) rather than loading it directly from a file. This allows it to be tested properly with an in-memory version.

Fixes #15

Note

Because the concrete Reader walks schema definitions, the data loaded is different than purely validating the metaschemas against their JSON definitions. This has pros and cons:

For example, this now catches:

TESTING: JSON files match their metaschema definitions
   FATAL: File at events/network/file_activity.json does not pass metaschema validation. Error: 'optional' is not one of ['recommended', 'required'] at JSON path: '$.attributes.connection_info.requirement'

Which is correct, we recently disallowed primary attributes to be optional, and the server believes that to be the case too:

image

But at face value, if I were new to OCSF and saw that error, I might be confused, because here's how connection_info in events/network/file_activity.json is defined:

    "connection_info": {
      "requirement": "optional"
    },

It's not obvious that the attribute is primary because the base network event defines:

    "connection_info": {
      "group": "primary",
      "requirement": "recommended"
    },
rmouritzen-splunk commented 8 months ago

After this is merged, we can begin using this repo's unit tests in the CI action.