Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add common device identifier fields to aid unique identification of Linux, Mac and Windows computers #1268

Merged
merged 4 commits into from
Dec 3, 2024

Conversation

antchan2
Copy link
Contributor

@antchan2 antchan2 commented Nov 26, 2024

Related Issue:

#1248

Description of changes:

This change adds two optional identifier fields to the Device object to aid combining telemetry for the same device from multiple sources :

  1. os_machine_uuid:

image

  1. device_hw_info.uuid

image

…inux, Mac and Windows computers

Signed-off-by: Anthony Chan <antchan2@cisco.com>
@antchan2 antchan2 changed the title Add common device identifier fields to aid unique identification of L… Add common device identifier fields to aid unique identification of Linux, Mac and Windows computers Nov 26, 2024
@jonrau-at-queryai
Copy link
Contributor

Could we remove the win and nix specific attributes out of the extension and just make them part of core os? We already have OS-specific attributes there after all

@pagbabian-splunk
Copy link
Contributor

Could we remove the win and nix specific attributes out of the extension and just make them part of core os? We already have OS-specific attributes there after all

The way I would suggest we do this: given that both machine identifiers are of type uuid_t I would just add one attribute, to device, machine_uuid (or machine_uid but NOT machine_id which we reserve for enums). In the description we can have both examples of where they are found, i.e. one for linux and one for Windows. Alternatively, these may be OS instance IDs, in which case we might consider that the machine_uuid is added to OS. Of course, the line is blurred in device.

@antchan2
Copy link
Contributor Author

antchan2 commented Nov 26, 2024

Thanks for the feedback, @jonrau-at-queryai, @pagbabian-splunk.

In commit 778e083, I consolidated the separate Windows and Linux Machine ID fields into a single device.os_machine_uuid field. This avoids extensions. I believe this field is a better fit in the device object than in os because while the value is assigned by the operating system, it describes the device and not the OS. I added an os_ prefix to the field name to more clearly communicate it is for the OS-assigned value, so one should also consult the os field for proper interpretation.

Let me know if this fully addresses your concerns.

floydtree
floydtree previously approved these changes Dec 2, 2024
…w_uuid_staging

Signed-off-by: Anthony Chan <antchan2@cisco.com>
@antchan2 antchan2 dismissed stale reviews from floydtree and jonrau-at-queryai via ff5e78f December 3, 2024 16:07
@jonrau-at-queryai jonrau-at-queryai merged commit ff3cdb9 into ocsf:main Dec 3, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants