Add url attribute to file object
#1291
Assignees
Labels
enhancement
New feature or request
non_breaking
Non Breaking, backwards compatible changes
v1.4.0
Changes marked for the upcoming version 1.4.0
Comments
rmouritzen-splunk
changed the title
url attribute to file object
|
Some extra context - we discussed this a bit in the 12/18/2024 system call and the group concluded that adding a |
rmouritzen-splunk
added
enhancement
rmouritzen-splunk
added a commit
to rmouritzen-splunk/ocsf-schema
that referenced
this issue
Dec 23, 2024
jonrau-at-queryai
added a commit
that referenced
this issue
Jan 6, 2025
#### Related Issue: #1291 #### Description of changes: Add `url` attribute to `file` object. See related issue for details. ### Delete once you have confirmed the following: 1. Did you add a single line summary of changes to `Unreleased` section in the [CHANGELOG.md](https://github.com/ocsf/ocsf-schema/blob/main/CHANGELOG.md) file? TBD Co-authored-by: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com>
jonrau-at-queryai
pushed a commit
that referenced
this issue
Jan 14, 2025
…c… (#1315) #### Related Issue: #1296 #### Description of changes: The existing File Hosting Activity class has attributes added to cover the file sharing access check case. A new "Access Check" Activity ID is added, and optional group context attributes are added.. This PR include a line in `CHANGELIST.md` for PR #1291, which was merged before the `CHANGELOG.md` was updated. NOTE: This PR replaces #1297, which was closed as it got mess up somehow. --------- Signed-off-by: Ania Kacewicz <ania.kacewicz@gmail.com> Co-authored-by: Ania Kacewicz <ania.kacewicz@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Summary
Add
urlas an optional attribute in thefileobject.Reasoning
The File Hosting Activity (6006) event class has no place to capture the URL of a file.
@zschmerber Hit this while creating OCSF events for Slack message that may include a file by URL in Network File Activity (4010 -- deprecated in favor of File Hosting Activity).
Email Activity (4009) has a similar issue.
We now have 2 (or more) situations where a
urlattribute inside thefileobject so it seems clear this is where the URL for File Hosting Activity should belong.cc: @mikeradka
The text was updated successfully, but these errors were encountered: