Added the is_alert flag to the dictionary, the security_control profile and detection_finding class

CHANGELOG.md

@@ -53,13 +53,17 @@ Thankyou! -->
     4. Added `forward_addr` as an `email_t`. #1179
     5. Added `related_cves`, `related_cwes` as arrays of `cve`, `cwe` respectively. #1176
     6. Added `exploit_last_seen_time` as a `timestamp_t`. #1176
+    7. Added `is_alert` as a `boolean_t`, #1179
+
 * #### Objects
     1. Added `environment_variable` object. #1172
     2. Added `advisory` object. #1176
 
 ### Improved
 * #### Event Classes
     1. Added `evidences` to `compliance_finding` class. #1157
+    2. Added `is_alert` to `detection_finding` and `data_security_finding` classes. #1178
+    3. Added `risk_details` to `data_security_finding` class
 * #### Objects
     1. Added `phone_number` to `user` and `ldap_person` objects. #1155
     2. Added `has_mfa` to `user` object. #1155
@@ -74,6 +78,11 @@ Thankyou! -->
 ### Bugfixes
 1. Added sibling definition to `confidence_id` in dictionary, accurately associating `confidence` as its sibling. #1180
 
+* #### Profiles
+    1. Added `is_alert`, `confidence_id`, `confidence`,  `confidence_score` attributes to the `security_control` profile. #1178
+    2. Added `risk_level_id`, `risk_level`, `risk_score`, `risk_details` attributes to the `security_control` profile.  #1178
+    3. Added `policy` attribute to the `security_control` profile. #1178
+
 ### Deprecated
 1. Deprecated `project_uid` in favor of `account.uid`. #1166
 2. Deprecated `kb_article_list` in favor of `advisory` in the vulnerability object. #1176

dictionary.json

@@ -2423,6 +2423,11 @@
       "description": "The IP address, in either IPv4 or IPv6 format.",
       "type": "ip_t"
     },
+    "is_alert": {
+      "caption": "Alert",
+      "description": "Indicates that the event is considered to be an alertable signal.",
+      "type": "boolean_t"
+    },
     "is_applied": {
       "caption": "Applied",
       "description": "A determination if a policy, rule, or enforcement action was applied.",

events/findings/data_security_finding.json

@@ -39,6 +39,21 @@
             "group": "context",
             "requirement": "recommended"
         },
+        "confidence": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },
+         "confidence_id": {
+            "profile": null,
+            "group": "context",
+            "requirement": "recommended"
+        },
+        "confidence_score": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },      
         "data_security": {
             "group": "context",
             "requirement": "recommended"
@@ -80,21 +95,34 @@
             "group": "context",
             "requirement": "optional"
         },
+        "is_alert": {
+            "profile": null,
+            "group": "primary",
+            "requirement": "recommended"
+        },      
         "resources": {
             "caption": "Affected Resources",
             "description": "Describes details about resources where classified or sensitive data is stored in, or was accessed from.",
             "group": "context",
             "requirement": "recommended"
         },
+        "risk_details": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },
         "risk_level": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },
         "risk_level_id": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },
         "risk_score": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },

events/findings/detection_finding.json

@@ -1,13 +1,28 @@
 {
   "uid": 4,
   "caption": "Detection Finding",
-  "description": "A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the <code>security_control</code> profile should be applied and its <code>attacks</code> information should be duplicated into the <code>finding_info</code> object.",
+  "description": "A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the <code>security_control</code> profile should be applied and its <code>attacks</code> information, if present, should be duplicated into the <code>finding_info</code> object.",
   "extends": "finding",
   "name": "detection_finding",
   "attributes": {
     "$include": [
       "profiles/security_control.json"
     ],
+    "confidence": {
+      "profile": null,
+      "group": "context",
+      "requirement": "optional"
+    },
+    "confidence_id": {
+      "profile": null,
+      "group": "context",
+      "requirement": "recommended"
+    },
+    "confidence_score": {
+      "profile": null,
+      "group": "context",
+      "requirement": "optional"
+    },
     "evidences": {
       "group": "primary",
       "description": "Describes various evidence artifacts associated to the activity/activities that triggered a security detection.",
@@ -25,6 +40,11 @@
       "group": "context",
       "requirement": "optional"
     },
+    "is_alert": {
+      "profile": null,
+      "group": "primary",
+      "requirement": "recommended"
+    },
     "remediation": {
       "group": "context",
       "requirement": "optional"
@@ -36,18 +56,22 @@
       "requirement": "recommended"
     },
     "risk_details": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_level": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_level_id": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_score": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },

profiles/security_control.json

@@ -1,5 +1,5 @@
 {
-  "description": "The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, firewall, or data control.  The profile is intended to augment activities or findings with an outcome where a security control has intervened.",
+  "description": "The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, firewall, or data control.  The profile is intended to augment activities or findings with an outcome where a security control has intervened. If the control detected a security violation, the <code>is_detection</code> flag should be set to <code>true</code>.",
   "meta": "profile",
   "caption": "Security Control",
   "name": "security_control",
@@ -37,17 +37,53 @@
     "authorizations": {
       "requirement": "optional"
     },
+    "confidence": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "confidence_id": {
+      "group": "context",
+      "requirement": "recommended"
+    },
+    "confidence_score": {
+      "group": "context",
+      "requirement": "optional"
+    },
     "disposition": {
       "requirement": "optional"
     },
     "disposition_id": {
       "requirement": "recommended"
     },
     "firewall_rule": {
-      "requirement": "optional"
+      "requirement": "optional",
+      "description": "The firewall rule that pertains to the control that triggered the event, if applicable."
+    },
+    "is_alert": {
+      "requirement": "recommended"
     },
     "malware": {
       "requirement": "optional"
+    },
+    "policy": {
+      "requirement": "optional",
+      "description": "The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."
+    },
+    "risk_details": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_level": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_level_id": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_score": {
+      "group": "context",
+      "requirement": "optional"
     }
   }
 }