Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add a Network Tunnel Activity Class #1012

Merged
merged 32 commits into from
Apr 11, 2024
Merged

Add a Network Tunnel Activity Class #1012

merged 32 commits into from
Apr 11, 2024

Conversation

mikeradka
Copy link
Contributor

@mikeradka mikeradka commented Apr 3, 2024 •
edited
Loading

Related Issue:

#908 (Create a Network Tunnel Activity Class)

Description of changes:

This PR creates a new class in the Network category to allow for OCSF support of Network Tunnel events spanning data sources including but not limited to Cisco ASA/FTD, Palo Alto Globalprotect, and other products that support network tunneling.

image

@mikeradka mikeradka added enhancement New feature or request network_activity Issues related to Network Activity Category v1.2.0 Changes marked for version v1.2.0 of OCSF labels Apr 3, 2024
@mikeradka mikeradka self-assigned this Apr 3, 2024
@mikeradka mikeradka requested a review from ablyler April 3, 2024 17:00
@mikeradka mikeradka changed the title Add a Network Tunneling Class DRAFT: Add a Network Tunneling Class Apr 3, 2024
@mikeradka mikeradka changed the title DRAFT: Add a Network Tunneling Class Add a Network Tunneling Class Apr 8, 2024
@mikeradka mikeradka marked this pull request as ready for review April 8, 2024 17:38
@mikeradka mikeradka changed the title Add a Network Tunneling Class Add a Network Tunnel Activity Class Apr 8, 2024
@mikeradka mikeradka requested a review from adplotzk April 9, 2024 14:53
Aniak5
Aniak5 reviewed Apr 9, 2024
View reviewed changes
dictionary.json Outdated Show resolved Hide resolved
Aniak5
Aniak5 reviewed Apr 9, 2024
View reviewed changes
dictionary.json Outdated Show resolved Hide resolved
Aniak5
Aniak5 reviewed Apr 9, 2024
View reviewed changes
dictionary.json Show resolved Hide resolved
Aniak5
Aniak5 reviewed Apr 9, 2024
View reviewed changes
objects/tunnel.json Outdated Show resolved Hide resolved
@mikeradka
Copy link
Contributor Author

Flattened the class per valuable feedback from mappers.

floydtree
floydtree previously approved these changes Apr 11, 2024
View reviewed changes
zschmerber
zschmerber previously approved these changes Apr 11, 2024
View reviewed changes
@Aniak5
Copy link
Contributor

Aniak5 commented Apr 11, 2024

This looks great @mikeradka! Thanks for creating this class. Just curious, is there a reason that we aren't extending the base network class? it seems like the additional attributes of tls, proxy and app_name could be applicable . Or were we trying to avoid all the network profiles?

@pagbabian-splunk pagbabian-splunk dismissed stale reviews from zschmerber, floydtree, and themself via 670ad7c April 11, 2024 16:51
@mikeradka
Update desc
4061b9f 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Add protocol attributes
c4bc802 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update desc
1810348 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Add associations
138c9da 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update caption
f050e77 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update desc
8e5ef26 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update desc
91d0506 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update caption
5416443 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update desc
0722bec 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update desc
d2c2b07 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Flatten the class per feedback
842acd8 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Add 0 and 99 activity_ids for good measure
1dbb978 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Add descriptions
963a31f 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Fix constraints
6fa1ca9 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Add group
c0bfb0c 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update associations per flattening
d26327b 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
remove tunnel object
ec13e02 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Update device definition
c9e05eb 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Replace 'client' with 'src_endpoint'
b8b8964 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Add network_proxy profile attributes
6dfa656 
Signed-off-by: Michael Radka <[email protected]>
@mikeradka
Extend network class
d09f622 
Signed-off-by: Michael Radka <[email protected]>
Aniak5
Aniak5 approved these changes Apr 11, 2024
View reviewed changes
Copy link
Contributor

@Aniak5 Aniak5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks awesome!

events/network/tunnel_activity.json Show resolved Hide resolved
events/network/tunnel_activity.json Outdated Show resolved Hide resolved
@mikeradka
Copy link
Contributor Author

This looks great @mikeradka! Thanks for creating this class. Just curious, is there a reason that we aren't extending the base network class? it seems like the additional attributes of tls, proxy and app_name could be applicable . Or were we trying to avoid all the network profiles?

It was really just for simplicity, but after we dug into it a bit further it looks like extending network gives the capability of adding some useful extra context. Thanks for suggesting! Change is in.

@zschmerber zschmerber merged commit 111f80a into ocsf:main Apr 11, 2024
2 checks passed
@mikeradka mikeradka deleted the network_tunneling_class branch April 15, 2024 18:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pagbabian-splunk pagbabian-splunk pagbabian-splunk approved these changes

@zschmerber zschmerber zschmerber approved these changes

@Aniak5 Aniak5 Aniak5 approved these changes

@ablyler ablyler Awaiting requested review from ablyler

@adplotzk adplotzk Awaiting requested review from adplotzk

@cmcginley-splunk cmcginley-splunk Awaiting requested review from cmcginley-splunk

@floydtree floydtree Awaiting requested review from floydtree floydtree is a code owner

Assignees

@mikeradka mikeradka

Labels
enhancement New feature or request network_activity Issues related to Network Activity Category v1.2.0 Changes marked for version v1.2.0 of OCSF
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@mikeradka @Aniak5 @zschmerber @pagbabian-splunk @floydtree @cmcginley-splunk