OCSF Schema Support #55
Conversation
frenchy64
force-pushed
the
ocsf-schema2
branch
from
75ea54c to
60603ea
Compare
| org.clojure/core.match {:mvn/version "1.0.0"} | ||
| prismatic/schema {:mvn/version "1.4.1"}} | ||
| :aliases {:test {:extra-paths ["test"] | ||
| prismatic/schema {:mvn/version "1.2.0"} |
There was a problem hiding this comment.
Why the downgrade on the schema version?
There was a problem hiding this comment.
IIRC the project.clj and deps.edn were out of sync. Since we use the jar, I figured the project.clj wins.
|
This is brilliant!! Exactly what I needed! |
|
I was testing out the work on this PR and I get a strange error that I'm scratching my head on. I created a gist describing my findings... |
|
@marioaquino thanks. Looks like the Cisco schema uses a vector of singleton maps for |
|
Done. I didn't realize Cisco OCSF schemas were different. Might make sense to export them to https://github.com/frenchy64/ocsf-schema-export. |
marioaquino
left a comment
marioaquino
left a comment
There was a problem hiding this comment.
This is fantastic and does exactly what I need! Great work, Ambrose!
|
Fantastic Ambrose! Let's get this merged and released. |
3 participants
Includes support for OCSF schemas.
OCSF exposes a simple format for schemas at e.g., https://schema.ocsf.io/api/classes/account_change
flanders.ocsfconverts this format to flanders.A separate project includes all the OCSF schemas, which we depend on via its jar during dev: https://github.com/frenchy64/ocsf-schema-export
We don't need the mainline OCSF schemas for now, we will vendor the Cisco variants during deployments.
The README in this PR describes how to use all this to create Plumatic Schema or Malli from OCSF schemas.
The unit tests boots a local ocsf-server and fuzz tests Plumatic Schema and Malli conversions against samples from https://schema.ocsf.io/doc/index.html#/Sample%20Data