New Profile for SaaS events

[odianosen]

I'm proposing adding a new profile to the core schema. Similar to the existing profiles, the idea is to have a set of attributes that cut across event classes and that represent events from SaaS apps.

{
  "description": "The attributes that relate to events from Software-as-a-Service apps.",
  "meta": "profile",
  "caption": "SaaS",
  "name": "saas",
  "annotations": {
    "group": "primary"
  },
  "attributes": {
    "app": {
      "description": "SaaS app attributes - id, name, vendor_name, version, etc. ",
      "type": "product",
      "requirement": "required"
    },
    "tenant": {
      "description": "SaaS tenant (or workspace) that is the source of the event",
      "requirement": "recommended"
    }
  }
}

app will be of type Product (https://schema.ocsf.io/objects/product)
tenant represents a Workspace (or similar) within the SaaS. It's a new proposed object that takes the form:

{
  "caption": "Tenant",
  "name": "tenant",
  "description": "The tenant object describes an organization of accounts or a shared space within a product.",
  "extends": "object",
  "attributes": {
    "domain": {
      "caption": "Tenant Domain",
      "description": "Domain that has been associated with the tenant",
      "requirement": "optional"
    },
    "name": {
      "caption": "Tenant Name",
      "description": "The name of the tenant.",
      "requirement": "recommended"
    },
    "type": {
      "description": "The type of the tenant. Examples are Asana Organization, Slack Workspace, Dropbox Team, etc",
      "caption": "Type",
      "requirement": "recommended"
    },
    "type_id": {
      "description": "The tenant type identifier.",
      "enum": {
        "0": {
          "caption": "Unknown"
        },
        "1": {
          "caption": "Organization"
        },
        "2": {
          "caption": "Workspace"
        },
        "3": {
          "caption": "Team"
        },
        "4": {
          "caption": "Account"
        },
        "99": {
          "caption": "Other"
        }
      },
      "caption": "Type ID",
      "requirement": "recommended",
      "name": "integer_t"
    },
    "uid": {
      "caption": "Tenant ID",
      "description": "The unique identifier of the tenant.",
      "requirement": "recommended"
    }
  },
  "constraints": {
    "at_least_one": [
      "name",
      "uid"
    ]
  }
}

[rroupski]

Where the SaaS profile will be used? Which classes or/and objects?

[odianosen]

It will be applied to Authentication, Account Change and a new class Resource Activity.

[pagbabian-splunk]

Now that we will have an Application category (proposed by @k2niner) and we won't have Resource Activity as a distinct class, would this also apply to Application Activity?

[odianosen]

@pagbabian-splunk Yes correct, it would apply to Application Activity.

[odianosen]

Bump. I would love some traction here.

[k2niner]

(1) Assuming tenant can be used in the larger cloud construct, should it be an attribute of the Cloud Profile? (2) Is there an avenue to having the required SaaS attributes populated as an element of the Cloud profile?

[odianosen]

cloud profile is a whole lot more generic and applicable to many more classes than a saas profile would. I'm not sure it's a good idea to populate so many existing classes with SaaS attributes when they are completely unrelated.