Incident Finding event class definition

[floydtree]

Related Issue: #902

Related PR: #786

Description of changes:

1. Refactoring, @maxhotta 's PR to account for the new finding_info object, removing duplicates, adding descriptions.
2. Removing separate enum definitions, since that concept has been deprecated in OCSF.

A few topics to discuss based on #786 -

1. findings_info vs finding_info_list - I am okay with either of the two, however finding_info_list makes it easier to distinguish it from finding_info. - based on weekly call - finding_info_list
2. user vs assignee - are both necessary in the class? - keeping assignee, adding assignee_group
3. incident_uid - haven't added it, metadata_uid should be used instead.

[pagbabian-splunk]

Generally looks good and needed for complettion.

Main comment so far: assignee could also be a group of users; typically in a SOC with shifts, incidents could be passed across shifts to users in a group.

[maxhotta]

Looks good to me as well. The only attribute that I noticed missing was the consolidated attacks array. I suspect it was removed for duplication as it's already a part of each of the findings?

[pagbabian-splunk]

Looks good to me as well. The only attribute that I noticed missing was the consolidated attacks array. I suspect it was removed for duplication as it's already a part of each of the findings?

That's what I would assume as well - the finding_info_list has finding_info.attacks for each Finding in the Incident.

However, there is an argument that the overall Incident could have its own attacks array, e.g. as a summary of what the Incident implies.

[floydtree]

Looks good to me as well. The only attribute that I noticed missing was the consolidated attacks array. I suspect it was removed for duplication as it's already a part of each of the findings?

That's what I would assume as well - the finding_info_list has finding_info.attacks for each Finding in the Incident.

Yep, that was the thought, but we can add a top level attacks as Paul suggested for an incident's summary of ttps.

[zschmerber]

LGTM

[Aniak5]

LGTM!