openc2 — archive

[David Lemire]

At our last TC meeting we spend some time discussing the recently announced Open Cybersecurity Schema Framework (OCSF). Just to get a sense, I started looking at the data types defined in OCSF, viewing them in their schema browser located at https://schema.ocsf.io/ The data types, specifically, are at https://schema.ocsf.io/data_types?extensions= I haven’t yet dived into a careful point-by-point comparison, but have some initial observations: 1. We have defined many of our data types that have some structure via a reference, whereas OCSF applies a regular _expression_, e.g., : · OpenC2:  email (String) Value must be an email address as defined in RFC5322, Section 3.4. · OCSF:  email_t (String)  ^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+.[a-zA-Z0-9-.]+$    Email address. For example: john_doe@example.com . 2. The layering of OCSF is going to make doing a thorough comparison a bit complicated, although I think a comparison of just their data types with ours is probably a useful start. There are only 22 base data types in OCSF, so that’s not terribly burdensome to examine. I think from there it’s probably best to move to their Attribute Dictionary, and then to Objects. 3. I’m still puzzling over some of their constructs. For example, there’s a File Name data type (file_name_t) defined as a string with a regular _expression_ constraint. But the File observable object has a Name field that’s only defined as of type String with not constraints. I would  have expected the object to invoke file_name_t but it doesn’t. Similarly, the object has a Path of type Path Name, which does correspond to a data type and so at least implicitly invokes the path_t type. Some of this might be the browser, because if I dig into the schema repo and look at the file object , it does invoke file_name_t. 4. Assuming we find at least some discrepancies, we’ll have to discuss whether it’s worth adjusting any of our type definitions to improve their alignments with OCSF’s definitions. Dave __________________ David Lemire IA Systems Engineer Mission Technologies (301) 575-5190 (o) (240) 938-9350 (m) HII.com