Samples have duplicate keys

[overly-engineered]

When getting samples from the OCSF site there are multiple records which have duplicate keys.

Examples:

Sample	Duplicates
https://schema.ocsf.io/sample/classes/dev/cloud_api	type_name
https://schema.ocsf.io/sample/classes/security_finding	type_name, class_name
https://schema.ocsf.io/sample/classes/network_activity	type_name, class_name

It looks like these are auto-generated with data. Happy to attempt a fix if you can point me in the right direction.

[rroupski]

I don't see duplicate keys. How can I reproduce the issue?

[overly-engineered]

I'm afraid I'm not really sure. Assuming that the samples are programmatically generated when hitting the cloud_api sample endpoint just now I receive this in response, which came with a duplicate type_name, severity and category_name keys

{
  "activity_id": 99,
  "api": {
    "operation": "substances wizard competitors",
    "response": {
      "code": 10,
      "error": "code inexpensive comprehensive",
      "error_message": "pregnant specialty micro",
      "message": "promotions dependence relationships"
    }
  },
  "category_name": "jobs bali child",
  "category_uid": 99938,
  "class_uid": 99938001,
  "cloud": {
    "account_uid": "23bcf1e6-d843-11ed-bc8b-0242ac110003",
    "provider": "linking outreach concerns",
    "region": "audit lip mario"
  },
  "confidence": 26,
  "metadata": {
    "logged_time": 1681201839230869,
    "logged_time_dt": "2023-04-11T08:30:39.230873Z",
    "original_time": "handheld compressed refinance",
    "processed_time": 1681201839230893,
    "product": {
      "lang": "en",
      "name": "silence checklist vendors",
      "vendor_name": "daisy prominent exams",
      "version": "1.0.0-rc.2"
    },
    "version": "1.0.0-rc.2"
  },
  "resources": [
    {
      "group_name": "harm freeze iv",
      "labels": ["barrel", "wildlife"],
      "name": "manchester alice interest",
      "owner": {
        "name": "Distributors",
        "org_uid": "23bcff38-d843-11ed-853e-0242ac110003",
        "type": "skill metres club"
      },
      "uid": "23bd0514-d843-11ed-a1b1-0242ac110003"
    },
    {
      "cloud_partition": "consortium faculty belief",
      "details": "manual brazil cfr",
      "group_name": "update land safer",
      "name": "washing holly publish",
      "owner": {
        "account_uid": "23bd0dac-d843-11ed-979a-0242ac110003",
        "credential_uid": "23bd114e-d843-11ed-9ef1-0242ac110003",
        "uid": "23bd14dc-d843-11ed-b78d-0242ac110003"
      },
      "type": "layer savings violin",
      "uid": "23bd18ce-d843-11ed-bcf7-0242ac110003"
    }
  ],
  "severity": "improvement escorts pontiac",
  "severity_id": 3,
  "src_endpoint": {
    "hostname": "identifier.store",
    "instance_uid": "23bccd24-d843-11ed-bea3-0242ac110003",
    "interface_name": "filed spas crest",
    "ip": "1.73.68.0",
    "port": 55920,
    "svc_name": "cbs likelihood dale",
    "uid": "23bcd440-d843-11ed-a197-0242ac110003",
    "vpc_uid": "23bcd83c-d843-11ed-aad5-0242ac110003"
  },
  "status_code": "eh",
  "status_detail": "recipients mo eye",
  "status_id": 0,
  "time": 1681201839230604,
  "timezone_offset": 72,
  "type_name": "Cloud API: Other",
  "type_uid": 9993800199,
  "activity_name": "stud",
  "category_name": "Cloud Activity",
  "class_name": "Cloud API",
  "severity": "Medium",
  "status": "Unknown",
  "type_name": "Cloud API: Operational"
}

[rroupski]

Yes, the samples are programmatically generated. However the code uses a map/dictionary, which don't support duplicate keys. Are you using the API or the web page link to get the samples?

[rroupski]

OK, finally I see the issue -- it affects the classes defined in an extension. thanks for finding it!

[rroupski]

Or not, I managed to see the issue using an extension class, but it is not easily reproducible. Anyway, I'll work on a fix for it.

[overly-engineered]

I have just been using the URL https://schema.ocsf.io/sample/classes/dev/cloud_api which is the dev extension. Let me know if I can do anything to help.