Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recursive network_proxy object #996

Open
overly-engineered opened this issue Mar 25, 2024 · 1 comment
Open

Recursive network_proxy object #996

overly-engineered opened this issue Mar 25, 2024 · 1 comment
Labels
network_activity Issues related to Network Activity Category

Comments

@overly-engineered
Copy link
Contributor

The network proxy endpoint contains a reference to itself a network proxy. This in itself is not a bad thing as there could be multiple proxy endpoints tied together however other places in the schema where recursive referencing of this type have warnings around how nested the data should be.

The ldap_person.manager field has a note to say this should only be applied once per event, the process.parent_process field has a similar note.
The analytic.related_analytic field was deprecated as of v1, but it would have faced the same issue.

Currently when being a consumer of OCSF there is no way to reliably parse the network_proxy object without recursively mapping out every proxy, which becomes doubly difficult when attempting to index the object.

@pagbabian-splunk
Copy link
Contributor

Thanks! Good observation - we want to avoid recursive definitions where possible but where we cannot, we SHOULD always at least indicate caution with a warning. We can add the warning and modify the description.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
network_activity Issues related to Network Activity Category
Projects
None yet
Development

No branches or pull requests

3 participants