Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move 'Network File Activity' and 'Email' classes to 'Application' category #905

Closed
mikeradka opened this issue Jan 2, 2024 · 9 comments
Closed
Assignees
Labels
application_activity Issues related to Application Activity Category deprecation A schema artifact is being deprecated network_activity Issues related to Network Activity Category non_breaking Non Breaking, backwards compatible changes v1.1.0 Changes marked for v1.1.0 of OCSF

Comments

@mikeradka
Copy link
Contributor

Network File Activity and Email Activity are much more based on the Application layer. The focal point of those logs are not the network transaction, but what the overarching applications are actually doing.

We are proposing to move these classes under the 'Application' category, which they are more appropriately suited.

Note: Doing so in a non-breaking manner will require class deprecation.

@mikeradka mikeradka added network_activity Issues related to Network Activity Category non_breaking Non Breaking, backwards compatible changes application_activity Issues related to Application Activity Category deprecation A schema artifact is being deprecated labels Jan 2, 2024
@mikeradka mikeradka self-assigned this Jan 2, 2024
@floydtree floydtree added the v1.1.0 Changes marked for v1.1.0 of OCSF label Jan 2, 2024
@mikeradka
Copy link
Contributor Author

mikeradka commented Jan 3, 2024

I don't recall us ever deprecating a class before. I am testing from my end, but it is possible that we might need to build a way to introduce class deprecation.

UPDATE: this class was deprecated: https://schema.ocsf.io/1.1.0-dev/classes/security_finding?extensions=

We should look into a way to denote deprecation on the class view page of the web ui (superscript, maybe?)

@mikeradka
Copy link
Contributor Author

mikeradka commented Jan 3, 2024

Per today's network call, we discussed the name of Network File Activity under Application

We are most likely landing on File Sync & Share or File Hosting

@Aniak5
Copy link
Contributor

Aniak5 commented Jan 3, 2024

Some other options are:

  • Web File Services
  • File Hosting Services
  • File Hosting Activity
  • Web File Activity

@mikeradka
Copy link
Contributor Author

Some other options are:

  • Web File Services
  • File Hosting Services
  • File Hosting Activity
  • Web File Activity

I would stray from Web File Activity, because this makes me think too much about the HTTP PUT/DELETE requests. Web File Services I think would also cause another circular discussion about "what is a web resource?", so I would opt against that to avoid the philosophical rabbit-hole.

Let's keep File Sync & Share and File Hosting Activity in the running for now.

@mikeradka
Copy link
Contributor Author

Vote created here: #909

Please cast your vote!

@mikeradka
Copy link
Contributor Author

Completed via #917

@mikeradka mikeradka changed the title Move 'Network File Activity' and 'Email' classes to 'Application' category Move 'Network File Activity' and 'Email' classes to 'Application' category (part 1 - network file activity) Jan 5, 2024
@mikeradka mikeradka changed the title Move 'Network File Activity' and 'Email' classes to 'Application' category (part 1 - network file activity) Move 'Network File Activity' and 'Email' classes to 'Application' category Jan 5, 2024
@mikeradka mikeradka reopened this Jan 5, 2024
@mikeradka
Copy link
Contributor Author

Network File Activity has been deprecated and replaced with Application -> File Hosting Activity.
Next will be a PR for the Email classes to move over to Application.

@mikeradka
Copy link
Contributor Author

PR is in to move the Email File/URL classes. Once this is merged this Issue can be closed.

@mikeradka
Copy link
Contributor Author

mikeradka commented Jan 9, 2024

In 1.1 preparation, we determined that Email File and URL classes need some work, and that should precede moving them to the Application category. Thus, those two classes will not be moved for the 1.1 release.

Created new issue #927 to track the 1.2 efforts.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
application_activity Issues related to Application Activity Category deprecation A schema artifact is being deprecated network_activity Issues related to Network Activity Category non_breaking Non Breaking, backwards compatible changes v1.1.0 Changes marked for v1.1.0 of OCSF
Projects
None yet
Development

No branches or pull requests

3 participants