Add security_control and host profiles to base_event.json

CHANGELOG.md

@@ -110,6 +110,8 @@ Thankyou! -->
     1. Added `risk_level_id`, `risk_level`, `risk_score`, `risk_details` attributes to the `security_control` profile.  #1178
     1. Added `policy` attribute to the `security_control` profile. #1178
     1. Added enum values to `action_id` of 'Observed', 'Modified', and 'Unknown'. #1265
+    1. Added `security_control` and `host` profiles to base_event.json #1270
+    1. Changed optionality of `action_id` in the `security_control` profile from `required` to `recommended` #1270
 * #### Objects
     1. Added `phone_number` to `user` and `ldap_person` objects. #1155
     1. Added `has_mfa` to `user` object. #1155

events/application/application_lifecycle.json

@@ -5,9 +5,6 @@
   "extends": "application",
   "name": "application_lifecycle",
   "attributes": {
-    "$include": [
-      "profiles/host.json"
-    ],
     "activity_id": {
       "requirement": "required",
       "enum": {
@@ -50,8 +47,5 @@
       "group": "primary",
       "requirement": "required"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/application/datastore_activity.json

@@ -5,9 +5,6 @@
     "extends": "application",
     "name": "datastore_activity",
     "attributes": {
-        "$include": [
-            "profiles/security_control.json"
-        ],
         "activity_id": {
             "enum": {
                 "1": {
@@ -128,8 +125,5 @@
             "databucket",
             "table"
         ]
-    },
-    "profiles": [
-        "security_control"
-    ]
+    }
 }

events/application/scan_activity.json

@@ -5,9 +5,6 @@
   "extends": "application",
   "name": "scan_activity",
   "attributes": {
-    "$include": [
-      "profiles/host.json"
-    ],
     "activity_id": {
       "enum": {
         "1": {
@@ -124,8 +121,5 @@
       "group": "primary",
       "requirement": "recommended"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/application/web_resource_access_activity.json

@@ -10,7 +10,6 @@
   },
   "attributes": {
     "$include": [
-      "profiles/host.json",
       "profiles/network_proxy.json"
     ],
     "activity_id": {
@@ -65,7 +64,6 @@
     }
   },
   "profiles": [
-    "host",
     "network_proxy"
   ]
 }

events/application/web_resources_activity.json

@@ -6,9 +6,7 @@
     "name": "web_resources_activity",
     "attributes": {
         "$include": [
-            "profiles/host.json",
-            "profiles/network_proxy.json",
-            "profiles/security_control.json"
+            "profiles/network_proxy.json"
         ],
         "activity_id": {
             "enum": {
@@ -81,8 +79,6 @@
         }
     },
     "profiles": [
-        "host",
-        "network_proxy",
-        "security_control"
+        "network_proxy"
     ]
 }

events/base_event.json

@@ -7,7 +7,9 @@
     "$include": [
       "profiles/cloud.json",
       "profiles/datetime.json",
-      "profiles/osint.json"
+      "profiles/host.json",
+      "profiles/osint.json",
+      "profiles/security_control.json"
     ],
     "activity_id": {
       "group": "classification",
@@ -138,6 +140,8 @@
   "profiles": [
     "cloud",
     "datetime",
-    "osint"
+    "host",
+    "osint",
+    "security_control"
   ]
 }

events/discovery/cloud_resources_inventory_info.json

@@ -60,8 +60,5 @@
       "resources",
       "table"
     ]
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/discovery/config_state.json

@@ -18,8 +18,5 @@
       "group": "primary",
       "requirement": "required"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/discovery/device_config_state_change.json

@@ -68,8 +68,5 @@
                 }
             }
         }
-    },
-    "profiles": [
-        "host"
-    ]
+    }
 }

events/discovery/discovery_result.json

@@ -5,9 +5,6 @@
   "extends": "base_event",
   "name": "discovery_result",
   "attributes": {
-    "$include": [
-      "profiles/host.json"
-    ],
     "activity_id": {
       "enum": {
         "1": {
@@ -29,8 +26,5 @@
       "group": "primary",
       "requirement": "required"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/discovery/inventory_info.json

@@ -14,8 +14,5 @@
       "group": "primary",
       "requirement": "required"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/discovery/patch_state.json

@@ -5,9 +5,6 @@
   "extends": "discovery",
   "name": "patch_state",
   "attributes": {
-    "$include": [
-      "profiles/host.json"
-    ],
     "device": {
       "group": "primary",
       "requirement": "required",
@@ -24,8 +21,5 @@
       "device.os.sp_ver",
       "device.os.version"
     ]
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/discovery/software_info.json

@@ -33,8 +33,5 @@
       "group": "context",
       "requirement": "optional"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/findings/data_security_finding.json

@@ -5,9 +5,6 @@
     "extends": "finding",
     "name": "data_security_finding",
     "attributes": {
-        "$include": [
-            "profiles/security_control.json"
-        ],
         "activity_id": {
             "description": "The normalized identifier of the Data Security Finding activity.",
             "requirement": "required",
@@ -141,8 +138,5 @@
             "group": "primary",
             "requirement": "recommended"
         }
-    },
-    "profiles": [
-        "security_control"
-    ]
+    }
 }

events/findings/detection_finding.json

@@ -5,9 +5,6 @@
   "extends": "finding",
   "name": "detection_finding",
   "attributes": {
-    "$include": [
-      "profiles/security_control.json"
-    ],
     "confidence": {
       "profile": null,
       "group": "context",
@@ -81,8 +78,5 @@
       "group": "context",
       "requirement": "optional"
     }
-  },
-  "profiles": [
-    "security_control"
-  ]
+  }
 }

events/findings/finding.json

@@ -5,9 +5,6 @@
   "extends": "base_event",
   "name": "finding",
   "attributes": {
-    "$include": [
-      "profiles/host.json"
-    ],
     "activity_id": {
       "description": "The normalized identifier of the finding activity.",
       "enum": {
@@ -97,8 +94,5 @@
     "vendor_attributes": {
       "requirement": "optional"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/iam/iam.json

@@ -5,9 +5,6 @@
   "extends": "base_event",
   "name": "iam",
   "attributes": {
-    "$include": [
-      "profiles/host.json"
-    ],
     "http_request": {
       "description": "Details about the underlying HTTP request.",
       "group": "context",
@@ -23,8 +20,5 @@
       "group": "primary",
       "requirement": "recommended"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/network/dhcp_activity.json

@@ -5,10 +5,6 @@
   "extends": "network",
   "name": "dhcp_activity",
   "attributes": {
-    "$include": [
-      "profiles/cloud.json",
-      "profiles/host.json"
-    ],
     "activity_id": {
       "requirement": "required",
       "enum": {
@@ -77,8 +73,5 @@
       "group": "primary",
       "requirement": "recommended"
     }
-  },
-  "profiles": [
-    "host"
-  ]
+  }
 }

events/network/email_activity.json

@@ -6,10 +6,6 @@
   "extends": "base_event",
   "name": "email_activity",
   "attributes": {
-    "$include": [
-      "profiles/host.json",
-      "profiles/security_control.json"
-    ],
     "activity_id": {
       "requirement": "optional",
       "enum": {
@@ -100,9 +96,5 @@
       "group": "primary",
       "requirement": "recommended"
     }
-  },
-  "profiles": [
-    "host",
-    "security_control"
-  ]
+  }
 }

events/network/email_file_activity.json

@@ -10,10 +10,6 @@
     "since": "1.3.0"
   },
   "attributes": {
-    "$include": [
-      "profiles/host.json",
-      "profiles/security_control.json"
-    ],
     "activity_id": {
       "requirement": "optional",
       "enum": {
@@ -38,9 +34,5 @@
       "group": "primary",
       "requirement": "required"
     }
-  },
-  "profiles": [
-    "host",
-    "security_control"
-  ]
+  }
 }