feat: [ocsf#1068] - external ticket - PR

CHANGELOG.md

@@ -45,7 +45,7 @@ Thankyou! -->
     1. Added `Event Log Activity` event class. #1014
 * #### Profiles
 * #### Objects
-    1. Added `external_ticket` object. #1068
+    1. Added `ticket` object. #1068
 * #### Platform Extensions
 
 ### Improved
@@ -57,7 +57,7 @@ Thankyou! -->
 * #### Profiles
 * #### Objects
     1.  Added `ext` to `File` object. #1046
-    2.  Added `external_ticket` to `Incident Findind` object. external_ticket. #1068
+    2.  Added `ticket` to `Incident Findind` object. ticket. #1068
 
 * #### Platform Extensions
 

dictionary.json

@@ -1666,11 +1666,6 @@
       "is_array": true,
       "type": "tls_extension"
     },
-    "external_ticket": {
-      "caption": "External Ticket",
-      "description": "The linked ticket in the external ticketing system.",
-      "type": "external_ticket"
-    },
     "factor_type": {
       "caption": "Factor Type",
       "description": "The type of authentication factor used in an authentication attempt.",
@@ -3997,6 +3992,36 @@
       "description": "The unique tenant identifier.",
       "type": "string_t"
     },
+    "ticket": {
+      "caption": "Ticket",
+      "description": "The linked ticket in the ticketing system.",
+      "type": "ticket"
+    },
+    "ticket_type": {
+      "caption": "Ticket Type",
+      "description": "The linked ticket type determines whether the ticket is internal or in an external ticketing system.",
+      "type": "string_t"
+    },
+    "ticket_type_id": {
+      "caption": "Ticket Type ID",
+      "description": "The normalized identifier for the ticket type.",
+      "enum": {
+        "0": {
+          "caption": "Unknown"
+        },
+        "1": {
+          "caption": "Internal"
+        },
+        "2": {
+          "caption": "External"
+        },
+        "99": {
+          "caption": "Other"
+        }
+      },
+      "sibling": "ticket_type",
+      "type": "integer_t"
+    },
     "title": {
       "caption": "Title",
       "description": "The title of an entity. See specific usage.",

events/findings/incident_finding.json

@@ -67,10 +67,6 @@
       "description": "The time of the most recent event included in the incident.",
       "requirement": "optional"
     },
-    "external_ticket": {
-      "group": "context",
-      "requirement": "optional"
-    },
     "finding_info_list": {
       "group": "primary",
       "requirement": "required"
@@ -136,6 +132,10 @@
       "group": "primary",
       "requirement": "required"
     },
+    "ticket": {
+      "group": "context",
+      "requirement": "optional"
+    },
     "is_suspected_breach": {
       "group": "context",
       "requirement": "optional"

objects/ticket.json

@@ -0,0 +1,32 @@
+{
+  "caption": "Ticket",
+  "name": "ticket",
+  "description": "The Ticket object represents ticket in the customer's systems like Salesforce, jira etc.",
+  "extends": "object",
+  "attributes": {
+    "src_url": {
+      "description": "The url of a ticket in the ticket system.",
+      "requirement": "recommended"
+    },
+    "uid": {
+      "description": "Unique ticket identifier like ticket id.",
+      "requirement": "recommended"
+    },
+    "ticket_type": {
+      "requirement": "optional"
+    },
+    "ticket_type_id": {
+      "requirement": "optional"
+    },
+    "title": {
+      "description": "The title of the ticket.",
+      "requirement": "optional"
+    }
+  },
+  "constraints": {
+    "at_least_one": [
+      "src_url",
+      "uid"
+    ]
+  }
+}