New Load Balancer object in HTTP Activity 4002

[nathanbvail]

I am creating this discussion to review a new Load Balancer object that contains the following attributes to capture logs from Load Balancing sources. This will initially be an optional attribute in the HTTP Activity class to capture Application Load Balancing logs and will ideally expand to additional classes as more Load Balancing related logs are mapped to OCSF (i.e. Network Activity class for Network Load Balancing logs)

The discussion we had during the call today covered the following two items:

• Potentially joining the Response Codes List attribute with a Destination Target List attribute into an optional object to capture Load Balancing logs presented in a list format (request routed to multiple destination targets & multiple response codes) .
• Having the LB Object extend object instead of _entity to change the Name & UID descriptions to be more Load Balancer specific.

Please share any thoughts or feedback regarding the current attributes pictured above and the discussion points from the call today (11/8/2023)

[nathanbvail]

{
    "caption": "Load Balancer",
    "name": "load_balancer",
    "extends": "_entity", 
    "description": "The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations.",
    "attributes": {
    "metrics": {
        "caption": "Metrics",
        "description": "The general purpose metrics associated with the Load Balancer.",
        "is_array": true,
        "requirement": "optional"
        },
    "dst_endpoint": { 
        "caption": "Destination Endpoint",
        "description": "The destination that the Load Balancer is distibuting traffic to.",
        "requirement": "required"
        },
    "code": {
        "caption": "Response Code",
        "description": "The numeric response status code detailing the connection from the Load Balancer to the destination target.",
        "requirement": "recommended"
        },
    "codes": {
        "caption": "Response Code List",
        "description": "A list of numeric response status codes detailing the connections from the Load Balancer to the destination targets.",
        "requirement": "optional"
        },
    "classification": {
        "caption": "Classification",
        "description": "The request classification as defined by the Load Balancer.",
        "requirement": "optional"
        },
    "status_detail": {
        "caption": "Status Details",
        "description": "The status details contains additional information about the event outcome.",
        "requirement": "optional"
        },
    "error_message": {
        "caption": "Error Message",
        "description": "The Load Balancer error message.",
        "requirement": "optional"
        },
    "message": {
        "caption": "Message",
        "description": "The Load Balancer message.",
        "requirement": "optional"
        }

    }
}

[nathanbvail]

Follow up comments from the discussion today - I am going to explore joining Response Codes List and Destination Target List by creating a new Destination Responses (name still WIP) object that contains an Endpoint Array ( Following the example of kb_articles ). This will create an array that allows the LB object to capture endpoint attributes. Going to move forwards and close this discussion and create a draft PR for additional review.