From 58549ef72ed34e80d41c3b19d71e504892ec2ee9 Mon Sep 17 00:00:00 2001 From: ryan Date: Mon, 9 Sep 2024 14:42:57 -0400 Subject: [PATCH] Sept 2024 pass at OCSF/DEFEND mappings --- extensions/windows/objects/registry_value.json | 2 +- objects/account.json | 2 +- objects/container.json | 2 +- objects/database.json | 2 +- objects/fingerprint.json | 2 +- objects/group.json | 2 +- objects/http_cookie.json | 2 +- objects/http_header.json | 2 +- objects/job.json | 2 +- objects/script.json | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/extensions/windows/objects/registry_value.json b/extensions/windows/objects/registry_value.json index ea93e9b64..c6b915c4b 100644 --- a/extensions/windows/objects/registry_value.json +++ b/extensions/windows/objects/registry_value.json @@ -1,6 +1,6 @@ { "caption": "Registry Value", - "description": "The registry value object describes a Windows registry value.", + "description": "The registry value object describes a Windows registry value. Defined by D3FEND d3f:WindowsRegistryValue.", "extends": "object", "name": "reg_value", "observable": 29, diff --git a/objects/account.json b/objects/account.json index 599e37d91..c4e9879fb 100644 --- a/objects/account.json +++ b/objects/account.json @@ -1,6 +1,6 @@ { "caption": "Account", - "description": "The Account object contains details about the account that initiated or performed a specific activity within a system or application. Additionally, the Account object refers to logical Cloud and Software-as-a-Service (SaaS) based containers such as AWS Accounts, Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects, and otherwise.", + "description": "The Account object contains details about the account that initiated or performed a specific activity within a system or application. Additionally, the Account object refers to logical Cloud and Software-as-a-Service (SaaS) based containers such as AWS Accounts, Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects, and otherwise. Defined by D3FEND d3f:UserAccount and D3FEND d3f:CloudUserAccount.", "name": "account", "extends": "_entity", "attributes": { diff --git a/objects/container.json b/objects/container.json index 34fc4609f..b57e729d0 100644 --- a/objects/container.json +++ b/objects/container.json @@ -2,7 +2,7 @@ "caption": "Container", "observable": 27, "name": "container", - "description": "The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.", + "description": "The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd. Defined by D3FEND d3f:ContainerImage.", "extends": "object", "attributes": { "name": { diff --git a/objects/database.json b/objects/database.json index 5a7a28f6d..b579f730f 100644 --- a/objects/database.json +++ b/objects/database.json @@ -1,6 +1,6 @@ { "caption": "Database", - "description": "The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.", + "description": "The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data. Defined by D3FEND d3f:Database.", "extends": "_entity", "name": "database", "profiles": [ diff --git a/objects/fingerprint.json b/objects/fingerprint.json index 4e5e847ba..0eadc5c17 100644 --- a/objects/fingerprint.json +++ b/objects/fingerprint.json @@ -1,6 +1,6 @@ { "caption": "Fingerprint", - "description": "The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data.", + "description": "The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data. Defined by D3FEND d3f:DigitalFingerprint.", "extends": "object", "name": "fingerprint", "observable": 30, diff --git a/objects/group.json b/objects/group.json index 88f6e73e4..47964748a 100644 --- a/objects/group.json +++ b/objects/group.json @@ -1,6 +1,6 @@ { "caption": "Group", - "description": "The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization.", + "description": "The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization. Defined by D3FEND d3f:AccessControlGroup.", "name": "group", "extends": "_entity", "attributes": { diff --git a/objects/http_cookie.json b/objects/http_cookie.json index 8db19533a..d5e92fa64 100644 --- a/objects/http_cookie.json +++ b/objects/http_cookie.json @@ -1,6 +1,6 @@ { "caption": "HTTP Cookie", - "description": "The HTTP Cookie object, also known as a web cookie or browser cookie, contains details and values pertaining to a small piece of data that a server sends to a user's web browser. This data is then stored by the browser and sent back to the server with subsequent requests, allowing the server to remember and track certain information about the user's browsing session or preferences.", + "description": "The HTTP Cookie object, also known as a web cookie or browser cookie, contains details and values pertaining to a small piece of data that a server sends to a user's web browser. This data is then stored by the browser and sent back to the server with subsequent requests, allowing the server to remember and track certain information about the user's browsing session or preferences. Defined by D3FEND d3f:SessionCookie.", "extends": "object", "name": "http_cookie", "attributes": { diff --git a/objects/http_header.json b/objects/http_header.json index a71c02cc6..ef2af7d9d 100644 --- a/objects/http_header.json +++ b/objects/http_header.json @@ -1,6 +1,6 @@ { "caption": "HTTP Header", - "description": "TThe HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.", + "description": "The HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.", "extends": "object", "name": "http_header", "attributes": { diff --git a/objects/job.json b/objects/job.json index 13a380687..3fdb49bcf 100644 --- a/objects/job.json +++ b/objects/job.json @@ -1,7 +1,7 @@ { "caption": "Job", "name": "job", - "description": "The Job object provides information about a scheduled job or task, including its name, command line, and state. It encompasses attributes that describe the properties and status of the scheduled job.", + "description": "The Job object provides information about a scheduled job or task, including its name, command line, and state. It encompasses attributes that describe the properties and status of the scheduled job. Defined by D3FEND d3f:ScheduledJob.", "extends": "object", "attributes": { "cmd_line": { diff --git a/objects/script.json b/objects/script.json index 6050053a1..fcb74f221 100644 --- a/objects/script.json +++ b/objects/script.json @@ -1,6 +1,6 @@ { "caption": "Script", - "description": "The Script object describes a script or command that can be executed by a shell, script engine, or interpreter. Examples include Bash, JavsScript, PowerShell, Python, VBScript, etc. Note that the term script here denotes not only a script contained within a file but also a script or command typed interactively by a user, supplied on the command line, or provided by some other file-less mechanism.", + "description": "The Script object describes a script or command that can be executed by a shell, script engine, or interpreter. Examples include Bash, JavsScript, PowerShell, Python, VBScript, etc. Note that the term script here denotes not only a script contained within a file but also a script or command typed interactively by a user, supplied on the command line, or provided by some other file-less mechanism. Defined by D3FEND d3f:ExecutableScript.", "extends": "object", "name": "script", "attributes": {