From 18df2dedacf6b6ebffcee40ae47de38a36eaeee8 Mon Sep 17 00:00:00 2001
From: Rick Mouritzen <rmouritzen@splunk.com>
Date: Sun, 10 Mar 2024 23:31:57 -0700
Subject: [PATCH 1/2] Add new ways to define observables to metaschema

---
 metaschema/dictionary-attribute.schema.json |  3 +++
 metaschema/event.schema.json                | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/metaschema/dictionary-attribute.schema.json b/metaschema/dictionary-attribute.schema.json
index 7803e990c..d41017033 100644
--- a/metaschema/dictionary-attribute.schema.json
+++ b/metaschema/dictionary-attribute.schema.json
@@ -52,6 +52,9 @@
         "is_array": {
             "type": "boolean",
             "description": "A flag used when the attribute represents an array of values rather than a single value."
+        },
+        "observable": {
+            "$ref": "observable.schema.json"
         }
     },
     "additionalProperties": false
diff --git a/metaschema/event.schema.json b/metaschema/event.schema.json
index 4b7fc9db5..8ab839bd0 100644
--- a/metaschema/event.schema.json
+++ b/metaschema/event.schema.json
@@ -37,6 +37,16 @@
                     "description": "A unique identifier for this event, must be unique within the category.",
                     "minimum": 0,
                     "maximum": 999
+                },
+                "observables": {
+                    "type": "object",
+                    "description": "Defines class-specific observables by attribute path.",
+                    "patternProperties": {
+                        "^[a-z0-9_]+(\\.[a-z0-9_]+)*$": {
+                            "$ref": "observable.schema.json"
+                        }
+                    },
+                    "additionalProperties": false
                 }
             },
             "additionalProperties": false

From 5f73be35025cc13f7626fc166c94a9e20153be25 Mon Sep 17 00:00:00 2001
From: Rick Mouritzen <rmouritzen@splunk.com>
Date: Sun, 10 Mar 2024 23:38:41 -0700
Subject: [PATCH 2/2] Update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c15f07123..599ceb23b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,7 @@ Thankyou! -->
 
 ### Misc
 1. New Extension registration for Sedara. #951
+2. Add new ways to define observables to metaschema. #982
 
 <!-- All available sections in the Changelog: