Modify Resource Object

[k2niner]

Proposing changes to Resource Object as part of a larger effort to introduce a Resource Activity class in Audit. I see a scenario where Resource Activity could absorb Entity Management but that is another proposal. First I want to address Resource Object.

Added: type_id with enums
Modified: type to align w/ type_id
Added: src_url
Added: file

{
  "description": "Describes details about resources that were affected by the activity/event.",
  "caption": "Resource",
  "name": "resource",
  "extends": "object",
  "attributes": {
    "account_uid":{
      "description": "The unique identifier of the account that owns the resource (e.g. AWS Account ID).",
      "requirement": "optional"
    },
    "cloud_partition": {
      "requirement": "optional"
    },
    "criticality": {
      "description": "The criticality of the resource.",
      "requirement": "optional"
    },
    "details": {
      "description": "Additional details describing the resource.",
      "requirement": "optional"
    },
    "device":{
      "description": "The device specific details, if the resource is a host/device.",
      "requirement": "optional"
    },
    "file":{
        "description": "The name of the file, if the resource is a file.",
        "requirement": "optional"
      },
    "group_name": {
      "requirement": "recommended"
    },
    "labels": {
      "requirement": "optional"
    },
    "name": {
      "description": "The name of the resource.",
      "requirement": "recommended"
    },
    "owner": {
      "description" : "The identity of the service or user account that owns the resource",
      "requirement": "recommended"
    },
    "region": {
      "description": "The region of the resource.",
      "requirement": "optional"
    },
    "type": {
      "description": "The The normalized type identifier of a Resource.",
      "requirement": "optional"
    },
    "type_id": {
        "description": "The resource type ID",
        "enum": {
          "1": {
            "caption": "Audit Log"
          },
          "2": {
            "caption": "Cloud Resource"
          },
          "3": {
            "caption": "Configuration"
          },
          "4": {
            "caption": "Device"
          },
          "5": {
            "caption": "Document"
          },
          "6": {
            "caption": "File"
          },
          "7": {
            "caption": "Folder"
          },
          "8": {
            "caption": "Group"
          },
          "9": {
            "caption": "OS"
          },
          "10": {
            "caption": "Security Policy"
          },
          "11": {
            "caption": "Service"
          },
          "12": {
            "caption": "System"
          },
          "13": {
            "caption": "User"
          },
          "14": {
            "caption": "Webpage"
          },
          "15": {
            "caption": "Other"
          },
          "99": {
            "caption": "Unknown"
        },
        "requirement": "required"
    },
    "uid": {
      "description": "The unique identifier of the resource.",
      "requirement": "recommended"
    },
    "src_url": {
        "description": "The URL pointing towards the source of the resource.",
        "requirement": "optional"
      }
  }
}

[floydtree]

The changes look good. However, note that this will be a breaking change since you are introducing a new required field (type_id) in the object.

The description of type needs to be updated to be consistent with other sibling fields in OCSF. Although we can iron such issues in the actual PR, the description should read -

The resource type, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the event source.

[k2niner]

Proposed changes to the above:

add type_id vale: "application"

[odianosen]

I agree with the general direction. As discussed with @k2niner offline, we should also include user of (User object type) and group (type Group) as top level attributes. We should also change file to have the type File, instead of string.

Smaller details: Unknown type_id for Unknown should be "0", and Other should be "99".

[rroupski]

the Other and Unknown should be:

          "99": {
            "caption": "Other"
          },
          "0": {
            "caption": "Unknown"

[pagbabian-splunk]

I feel we need to think this through a bit more, especially in light of the intention of introducing a very general Resource Activity.
If we look at the System Activity classes, e.g. File System Activity, it would overlap with the Resource object as proposed by including the File object.

If there was an associated Resource Activity class, I wouldn't know which one to populate. There would be two ways of doing the same thing. This isn't the case for every resource in the list though, e.g. we don't have Document Activity, but I'm not sure how that would differ from File System Activity or Network File Activity (e.g. the Box events).

Considering the object enhancement alone, If this object becomes a "resource descriptor" rather than the resource itself, it might work better, since the resource itself is already a member of more specific classes. E.g. if the file was on an EBS volume, and I wanted information about what cloud partition and region, this object would tell me that.

What I feel is important in the proposed Resource object enhancement is the addition of the type_id enum. Having only a type without any guidance on how to populate it means every one for themselves - effectively Other for every producer or mapper. But embedding the actual resource itself becomes inconsistent: there is no Document attribute, no User attribute, no Security Policy attribute, no WebPage attribute; but there is a File attribute, a Device attribute.

[k2niner]

Started a discussion on Slack.

https://opencybersecu-lz97379.slack.com/archives/C03C2QPSBPB/p1678455114481899

[pagbabian-splunk]

Good discussion - I added a modified proposal, based on your proposal and our discussion at #520 .

[floydtree]

New resource object based on March 15th Meeting -

Notes/Changelog (compared to in prod resource object):

1. cloud_partition, region will be moved to the cloud profile - Implementation - @floydtree @rroupski
2. device is removed
3. details is replaced by data
4. group_name is replaced by group, should use group.name instead
5. type is removed
6. resource_type and resource_type_id are added
7. account_uid is removed, should use owner.account_uid instead
8. version is added

{
  "description": "Describes details about resources that were affected by the activity/event.",
  "caption": "Resource",
  "name": "resource",
  "extends": "object",
  "attributes": {
    "criticality": {
      "description": "The criticality of the resource.",
      "requirement": "optional"
    },
    "data": {
      "description": "Additional data describing the resource.",
      "requirement": "optional"
    },
    "group": {
      "requirement": "recommended"
    },
    "labels": {
      "requirement": "optional"
    },
    "name": {
      "description": "The name of the Resource.",
      "requirement": "recommended"
    },
    "owner": {
      "description" : "The identity of the service or user account that owns the resource",
      "requirement": "recommended"
    },
    "resource_type": {
      "description": "The The normalized type identifier of a Resource.",
      "requirement": "optional"
    },
    "resource_type_id": {
        "description": "The resource type ID",
        "enum": {
          "1": {
            "caption": "Audit Log"
          },
          "2": {
            "caption": "Cloud Resource"
          },
          "3": {
            "caption": "Configuration"
          },
          "4": {
            "caption": "Device"
          },
          "5": {
            "caption": "Document"
          },
          "6": {
            "caption": "File"
          },
          "7": {
            "caption": "Folder"
          },
          "8": {
            "caption": "Group"
          },
          "9": {
            "caption": "OS"
          },
          "10": {
            "caption": "Security Policy"
          },
          "11": {
            "caption": "Service"
          },
          "12": {
            "caption": "System"
          },
          "13": {
            "caption": "User"
          },
          "14": {
            "caption": "Webpage"
          },
          "15": {
            "caption": "Other"
          },
          "99": {
            "caption": "Unknown"
        },
        "requirement": "recommended"
    },
    "uid": {
      "description": "The unique identifier of the resource.",
      "requirement": "recommended"
    },
    "version":{
      "description": "The version of the resource. For example <code>1.2.3</code>.",
      "requirement": "optional"
    },
  }
}

1. Every 'resource' type object will extend this object - Identity such objects - Implementation - ??
2. Is the resource_type_id enum good to be implemented?

[rroupski]

looks very good!

[pagbabian-splunk]

I think we need to add version still (from Managed Entity). svc_name is in the win_resource object, is that worth adding generally?

[floydtree]

Good catch, added in version.
Not sure svc_name is worth the general addition though, if someone wants to map service name in the resource object, they can use the name attribute instead and use the resource_type= "Service"

[irakledibm]

looks good

[pagbabian-splunk]

Good catch, added in version. Not sure svc_name is worth the general addition though, if someone wants to map service name in the resource object, they can use the name attribute instead and use the resource_type= "Service"

I think you are right about svc_name; if you aren't using it already, which you aren't. It is in the win_resource object, which we are going to convert into a profile with a resource_type_id override, if needed it can be part of the profile.

[pagbabian-splunk]

This has been resolved in RC3 with resource_details and web_resource.