Sept 2024 pass at OCSF/DEFEND mappings

CHANGELOG.md

@@ -58,6 +58,7 @@ Thankyou! -->
     2. Added `has_mfa` to `user` object. #1155
     3. Added `vendor_name` to `cvss` object. #1165
     4. Added `file`, `reputation`, `subnet`, and `script` to `osint` object. #1168
+    5. Added d3fend mappings to the description field of `registry_value`, `account`, `container`, `database`, `fingerprint`, `group`, `http_cookie`, `job`, and `script` #1173
 
 ### Deprecated
 1. Deprecated `project_uid` in favor of `account.uid`. #1166

extensions/windows/objects/registry_value.json

@@ -1,6 +1,6 @@
 {
   "caption": "Registry Value",
-  "description": "The registry value object describes a Windows registry value.",
+  "description": "The registry value object describes a Windows registry value. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:WindowsRegistryValue/'>d3f:WindowsRegistryValue</a>.",
   "extends": "object",
   "name": "reg_value",
   "observable": 29,

objects/account.json

@@ -1,6 +1,6 @@
 {
   "caption": "Account",
-  "description": "The Account object contains details about the account that initiated or performed a specific activity within a system or application. Additionally, the Account object refers to logical Cloud and Software-as-a-Service (SaaS) based containers such as AWS Accounts, Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects, and otherwise.",
+  "description": "The Account object contains details about the account that initiated or performed a specific activity within a system or application. Additionally, the Account object refers to logical Cloud and Software-as-a-Service (SaaS) based containers such as AWS Accounts, Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects, and otherwise. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/'>d3f:UserAccount</a> and D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:CloudUserAccount/'>d3f:CloudUserAccount</a>.",
   "name": "account",
   "extends": "_entity",
   "attributes": {

objects/container.json

@@ -2,7 +2,7 @@
   "caption": "Container",
   "observable": 27,
   "name": "container",
-  "description": "The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.",
+  "description": "The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:ContainerProcess/'>d3f:ContainerProcess</a>.",
   "extends": "object",
   "attributes": {
     "name": {

objects/database.json

@@ -1,6 +1,6 @@
 {
   "caption": "Database",
-  "description": "The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.",
+  "description": "The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:Database/'>d3f:Database</a>.",
   "extends": "_entity",
   "name": "database",
   "profiles": [

objects/fingerprint.json

@@ -1,6 +1,6 @@
 {
   "caption": "Fingerprint",
-  "description": "The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data.",
+  "description": "The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:DigitalFingerprint/'>d3f:DigitalFingerprint</a>.",
   "extends": "object",
   "name": "fingerprint",
   "observable": 30,

objects/group.json

@@ -1,6 +1,6 @@
 {
   "caption": "Group",
-  "description": "The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization.",
+  "description": "The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:AccessControlGroup/'>d3f:AccessControlGroup</a>.",
   "name": "group",
   "extends": "_entity",
   "attributes": {

objects/http_cookie.json

@@ -1,6 +1,6 @@
 {
   "caption": "HTTP Cookie",
-  "description": "The HTTP Cookie object, also known as a web cookie or browser cookie, contains details and values pertaining to a small piece of data that a server sends to a user's web browser. This data is then stored by the browser and sent back to the server with subsequent requests, allowing the server to remember and track certain information about the user's browsing session or preferences.",
+  "description": "The HTTP Cookie object, also known as a web cookie or browser cookie, contains details and values pertaining to a small piece of data that a server sends to a user's web browser. This data is then stored by the browser and sent back to the server with subsequent requests, allowing the server to remember and track certain information about the user's browsing session or preferences. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:SessionCookie/'>d3f:SessionCookie</a>.",
   "extends": "object",
   "name": "http_cookie",
   "attributes": {

objects/http_header.json

@@ -1,6 +1,6 @@
 {
   "caption": "HTTP Header",
-  "description": "TThe HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.",
+  "description": "The HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.",
   "extends": "object",
   "name": "http_header",
   "attributes": {

objects/job.json

@@ -1,7 +1,7 @@
 {
   "caption": "Job",
   "name": "job",
-  "description": "The Job object provides information about a scheduled job or task, including its name, command line, and state. It encompasses attributes that describe the properties and status of the scheduled job.",
+  "description": "The Job object provides information about a scheduled job or task, including its name, command line, and state. It encompasses attributes that describe the properties and status of the scheduled job. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:ScheduledJob/'>d3f:ScheduledJob</a>.",
   "extends": "object",
   "attributes": {
     "cmd_line": {

objects/script.json

@@ -1,6 +1,6 @@
 {
   "caption": "Script",
-  "description": "The Script object describes a script or command that can be executed by a shell, script engine, or interpreter. Examples include Bash, JavsScript, PowerShell, Python, VBScript, etc. Note that the term <em>script</em> here denotes not only a script contained within a file but also a script or command typed interactively by a user, supplied on the command line, or provided by some other file-less mechanism.",
+  "description": "The Script object describes a script or command that can be executed by a shell, script engine, or interpreter. Examples include Bash, JavsScript, PowerShell, Python, VBScript, etc. Note that the term <em>script</em> here denotes not only a script contained within a file but also a script or command typed interactively by a user, supplied on the command line, or provided by some other file-less mechanism. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:ExecutableScript/'>d3f:ExecutableScript</a>.",
   "extends": "object",
   "name": "script",
   "attributes": {