Skip to content

v0.2.0

v0.2.0 — OCSF 1.9: IAM, Entity/Group and API Activity classes
@docJerem docJerem tagged this 24 Sep 14:07 
Moves the library from OCSF 1.8 to OCSF 1.9.0 and adds the IAM and
Application Activity classes a product needs for its audit trail.

New classes:
- Entity Management (3004): OCSF.Events.EntityManagement + OCSF.Entity
- Group Management (3006): OCSF.Events.GroupManagement + OCSF.Group,
  including the 1.9 activities 9-13
- Authorize Session (3003): assign_privileges, assign_groups, assign_roles
- User Management (3007): 19 account lifecycle activities
- Role Management (3008): 11 role lifecycle activities + OCSF.IamRole
- API Activity (6003): create, read, update, delete + OCSF.Api

New objects and fields:
- OCSF.Api, OCSF.IamRole, OCSF.ResourceDetails
- OCSF.Event gains updated_user, groups, iam_role, iam_roles,
  updated_role, privileges and resources, wired through serialization,
  deserialization, OCSF.Policy redaction and OCSF.validate/1
- OCSF.Flatten.unflatten/1, the inverse of flatten/1
- OCSF.supported_versions/0 (1.8.0 and 1.9.0)

Sink:
- OCSF.Sink row_for/1 and policy/0 are optional callbacks, so a sink
  that is not an OCSF projection implements only write/1 and health/0

Breaking changes:
- metadata.version is 1.9.0 (read it from OCSF.version/0)
- 3003 is :"Authorize Session", not :Authorization; activity 2 is
  Assign Groups
- resources is a list of OCSF.ResourceDetails maps (%{uid, name}),
  not strings
- OCSF.validate/1 enforces the 1.9 at_least_one constraints: an
  Authentication (3002) event needs service or dst_endpoint
- a field of the wrong type returns an OCSF.Error with reason
  :type_mismatch instead of raising

Conformance: compiled 1.9.0 schemas vendored under
test/fixtures/ocsf_schema/1.9/ with per-class conformance tests.
86 doctests, 557 tests, 0 failures.
Assets 2
Loading