Proposal for including Proxy connection details and ICAP to Network Activity

[maxhotta]

I'd like to propose a set of changes (discussed with @Aniak5) to the network activity event class to support proxy and ICAP use cases.
The problem is that currently, we cannot capture the proxy connection details if they differ from the main connection attributes. The proposal is the following:

• Add a proxy_connection field to Network Activity as Optional (type is network_connection_info)
• Add a proxy_tls field to Network Activity as Optional (type is tls)
  • Alternatively move the TLS object into the Network Connection Information object (this would be a breaking change, and thus not the first suggestion)
• Create an ICAP object:

{
  "caption": "ICAP",
  "name": "icap",
  "description": "The ICAP object describes the Internet Content Adaptation Protocol.",
  "extends": "object",
  "attributes": {
    "status": {
      "description": "The ICAP Response or Request modification status.",
      "requirement": "recommended"
    },
    "status_detail": {
      "description": "The ICAP Response or Request modification result or error status detail.",
      "requirement": "optional"
    },
    "data": {
      "description": "The details of the ICAP Response or Request Modification(s).",
      "requirement": "optional"
    },
    "service": {
      "description": "The details of the ICAP service.",
      "requirement": "optional"
    }
  }
}

• Add two ICAP array fields to the Network Activity class as Optional

{
   "icap_reqmod": {
      "caption": "ICAP reqmod",
      "description": "The ICAP Request Modification Mode details.",
      "type": "icap",
      "is_array": true
    },
    "icap_respmod": {
      "caption": "ICAP respmod",
      "description": "The ICAP Response Modification Mode details.",
      "type": "icap",
      "is_array": true
    }
}

[Aniak5]

What are your thoughts on creating a new proxy traffic object that contains connection_info, tls as well as the network endpoint attributes that the proxy attribute already has?

If the ICAP activities are important to your use case, then this might warrant its own ICAP event class.

[maxhotta]

I'm open to discussion on how we model/capture the proxy info and the suggestion above would work as well if we feel that capturing it that way is more consistent within ocsf. But our use case for ICAP calls for including it in the same event class as the one logged for the network activity. Currently, this is modeled as a single event in our product, and we'd like to avoid creating two events to describe the activity.

[maxhotta]

Per discussion, I will create a new proposal for a new Proxy profile and modifications to the Proxy object.