Skip to content

v0.1.0

v0.1.0 — Postgres sink for OCSF 1.9 events
@docJerem docJerem tagged this 24 Sep 14:41 
First release of ocsf_ecto, the Postgres companion of the ocsf library
(requires ocsf ~> 0.2, OCSF 1.9).

Features:
- OCSF.Ecto.Sink: OCSF.Sink implementation backed by Ecto + postgrex;
  synchronous bulk insert, idempotent on metadata.uid, :telemetry spans
- Single flat table ocsf_event__logs: nested OCSF paths projected with
  the __ separator (user.email_addr -> user__email_addr), jsonb columns
  for sub-objects and lists
- OCSF.Ecto.Migration: versioned, Oban-style DDL (V1 table, V2
  completeness columns) to call from the host app's migrations
- OCSF.Ecto.Event: schema of the stored row; to_ocsf_map/1 rebuilds the
  canonical nested OCSF event and its labels (class_name, severity...)
- Jason.Encoder for OCSF.Ecto.Event: a stored row encodes to canonical
  OCSF 1.9 JSON
- Field-level encryption at rest with Cloak (AES-GCM) for PII data
  classes (:contact, :identity) and PII sub-objects (actor,
  updated_user, entity)
- Policy-driven redaction before insert: denied data classes become nil
- Configurable Repo via config :ocsf_ecto, :repo, honouring start: false

OCSF 1.9: resources stored as OCSF.ResourceDetails maps, emitted
metadata.version read from OCSF.version/0.
Assets 2
Loading