Further Enhance the Modified Resource Object (refer to Proposal #499)

[pagbabian-splunk]

Per discussion, #499 and https://opencybersecu-lz97379.slack.com/archives/C03C2QPSBPB/p1678455114481899, I took a shot at enhancing and tweaking @k2niner Kevin's resource object. The intent was to fix the standard enums, called out by @rroupski-splunk but also to further generalize it so that it could be used for managed_entity rather than having a discrete object for that attribute (the type of entity would need to be changed to resource from managed_entity).

Note: the enum values need descriptions: e.g. for Platform Specific, 'additional resources added via a Profile`

As with #499 this is breaking due to the type_id addition being Required.

Added: data and version, from managed_entity; is_managed
Added: policy and user for when the resource is one of those, consistent with file and device
Modified: some descriptions, for example for file to include document, folder, configuration file enum types
Modified: the enum list, fixing the standard Unknown and Other, and adding Platform Specific (98)

{
  "description": "Describes details about resources that were affected by the activity/event.",
  "caption": "Resource",
  "name": "resource",
  "extends": "object",
  "attributes": {
    "account_uid":{
      "description": "The unique identifier of the account that owns the resource (e.g. AWS Account ID).",
      "requirement": "optional"
    },
    "cloud_partition": {
      "requirement": "optional"
    },
    "criticality": {
      "description": "The criticality of the resource.",
      "requirement": "optional"
    },
    "data": {
      "description": "The resource content as a JSON object.",
      "requirement": "optional"
    },
    "details": {
      "description": "Additional details describing the resource.",
      "requirement": "optional"
    },
    "device":{
      "description": "The device specific details, if the resource is a host/device.",
      "requirement": "optional"
    },
    "file":{
      "description": "The name of the file, if the resource is a file, folder, document or configuration file.",
      "requirement": "optional"
    },
    "group_name": {
      "requirement": "recommended"
    },
    "is_managed": {
      "requirement": "optional"
    },
    "labels": {
      "requirement": "optional"
    },
    "name": {
      "description": "The name of the resource.",
      "requirement": "recommended"
    },
    "owner": {
      "description" : "The identity of the service or user account that owns the resource",
      "requirement": "recommended"
    },
    "policy": {
      "requirement": "optional",
      "description": "Policy details, if the resource is a policy."
    },
    "region": {
      "description": "The region of the resource.",
      "requirement": "optional"
    },
    "type": {
      "description": "The type of the resource.",
      "requirement": "optional"
    },
    "type_id": {
      "description": "The resource type ID",
      "enum": {
        "0": {
          "caption": "Unknown"
        },
        "1": {
          "caption": "Audit Log"
        },
        "2": {
          "caption": "Cloud Resource"
        },
        "3": {
          "caption": "Configuration"
        },
        "4": {
          "caption": "Device"
        },
        "5": {
          "caption": "Document"
        },
        "6": {
          "caption": "File"
        },
        "7": {
          "caption": "Folder"
        },
        "8": {
          "caption": "Group"
        },
        "9": {
          "caption": "OS"
        },
        "10": {
          "caption": "Security Policy"
        },
        "11": {
          "caption": "Service"
        },
        "12": {
          "caption": "System"
        },
        "13": {
          "caption": "User"
        },
        "14": {
          "caption": "Webpage"
        },
        "98": {
          "caption": "Platform Specific"
        },
        "99": {
          "caption": "Other"
      },
        "requirement": "required"
      }
    }, 
    "src_url": {
      "description": "The URL pointing towards the source of the resource.",
      "requirement": "optional"
    },
    "uid": {
      "description": "The unique identifier of the resource.",
      "requirement": "recommended"
    },
    "user": {
      "description": "Details about the user, if the resource is a user.",
      "requirement": "optional"
    },
    "version": {
      "description": "The version of the resource. For example <code>1.2.3</code>.",
      "requirement": "optional"
    }
  }
}

[odianosen]

Some thoughts:

• Some top-level attributes seem to be just the name of the resource (file, group_name) and others seem to be the full resource object (user, device). Should these all be changed to their corresponding objects (File, Group, User and Device) and let the name attribute contain the resource name?

• Continuing the discussion from slack, is there concern that this object is too broad? It's basically a catch-all for everything, and will likely grow as more and more resource types (and corresponding objects) are added to it. It seems to me that event classes that use this object will necessarily inherit its overly broad nature.