SentinelOne v1.1.0 subset

events/discovery/discovery_result.json

@@ -0,0 +1,39 @@
+{
+  "caption": "Discovery Result",
+  "category": "discovery",
+  "name": "discovery_result",
+  "extends": "base_event",
+  "description": "Discovery Result events report the results of a discovery request.",
+  "profiles": [
+    "host"
+  ],
+  "attributes": {
+    "$include": [
+      "profiles/host.json"
+    ],
+    "activity_id": {
+      "enum": {
+        "1": {
+          "caption": "Exists",
+          "description": "The target was found."
+        },
+        "2": {
+          "caption": "Partial",
+          "description": "The target was partially found."
+        },
+        "3": {
+          "caption": "Does not exist",
+          "description": "The target was not found."
+        },
+        "4": {
+          "caption": "Error",
+          "description": "The discovery attempt failed."
+        },
+        "5": {
+          "caption": "Unsupported",
+          "description": "Discovery of the target was not supported."
+        }
+      }
+    }
+  }
+}

events/discovery/user_info.json

@@ -0,0 +1,13 @@
+{
+  "caption": "User Info",
+  "description": "User Info events report user data that have been discovered, queried, polled or searched. This event differs from User Inventory as it describes the result of a targeted search by filtering a subset of user attributes.",
+  "extends": "discovery_result",
+  "name": "user_info",
+  "uid": 18,
+  "attributes": {
+    "user": {
+      "group": "primary",
+      "requirement": "required"
+    }
+  }
+}

objects/metadata.json

@@ -4,13 +4,28 @@
   "extends": "object",
   "name": "metadata",
   "attributes": {
-    "correlation_uid": {},
+    "correlation_uid": {
+      "requirement": "optional"
+    },
     "event_code": {
       "requirement": "optional"
     },
-    "extension": {},
+    "extension": {
+      "requirement": "optional",
+      "@deprecated": {
+        "message": "Use the <code> extensions </code> attribute instead.",
+        "since": "v1.0.0"
+      }
+    },
+    "extensions": {
+      "requirement": "optional"
+    },
     "labels": {
-      "description": "<p>The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.</p>For example: <code>[\"network\", \"connection.ip:destination\", \"device.ip:source\"]</code>"
+      "description": "<p>The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.</p>For example: <code>[\"network\", \"connection.ip:destination\", \"device.ip:source\"]</code>",
+      "requirement": "optional"
+    },
+    "log_level": {
+      "requirement": "optional"
     },
     "log_name": {
       "requirement": "recommended"
@@ -21,26 +36,38 @@
     "log_version": {
       "requirement": "optional"
     },
-    "logged_time": {},
+    "logged_time": {
+      "requirement": "optional"
+    },
     "modified_time": {
-      "description": "The time when the event was last modified or enriched."
+      "description": "The time when the event was last modified or enriched.",
+      "requirement": "optional"
     },
+    "loggers": {},
     "original_time": {
       "requirement": "recommended"
     },
-    "processed_time": {},
+    "processed_time": {
+      "requirement": "optional"
+    },
     "product": {
       "requirement": "required"
     },
-    "profiles": {},
-    "sequence": {},
+    "profiles": {
+      "requirement": "optional"
+    },
+    "sequence": {
+      "requirement": "optional"
+    },
+    "tenant_uid": {
+      "requirement": "recommended"
+    },
     "uid": {
       "caption": "Event UID",
       "description": "The logging system-assigned unique identifier of an event instance.",
       "requirement": "optional"
     },
     "version": {
-      "default": "1.0.0",
       "description": "The version of the OCSF schema, using Semantic Versioning Specification (<a target='_blank' href='https://semver.org'>SemVer</a>). For example: 1.0.0. Event consumers use the version to determine the available event attributes.",
       "requirement": "required"
     }