Skip to content

Give the OCSF allow decision its own class entry - #278

Open
imran-siddique wants to merge 2 commits into
GenAI-Security-Project:integrationfrom
imran-siddique:spec/198-ocsf-allow-class
Open

Give the OCSF allow decision its own class entry#278
imran-siddique wants to merge 2 commits into
GenAI-Security-Project:integrationfrom
imran-siddique:spec/198-ocsf-allow-class

Conversation

@imran-siddique

@imran-siddique imran-siddique commented Oct 15, 2026

Copy link
Copy Markdown

What changed

decision_class in ocsf-mapping.json gains allow_class: class_uid 6002, class_name "Application Lifecycle", and required_fields naming where the disposition goes (unmapped.acs.decision), plus severity_id, metadata.correlation_uid and the join pair. The evaluator rides in unmapped.acs.metadata, as on a 2004. The prose rule, which still said "Application Activity" after #258, now points at it. events.md and extend_ocsf.md get the Decision (allow) row, and test_trace_mapping_defaults.py checks the caption matches the 6002 rows.

The opt-in to record allows as Detection Findings stays. Dropping it is a one-line follow-up if the Spec leads want one class.

Which issue does this implement

Fixes #198

Base branch

  • integration

Type of change

  • Specification change
  • Documentation

Specification changes

  • I opened a Discussion before this PR (the issue is status:accepted)
  • Schema changes validate against the JSON Schema spec
  • I described the impact on downstream implementers below

Breaking for implementers? No. Every class_uid and existing default is unchanged; activity_id for 6002 stays with #235.

I tested this

  • Synced with integration at c82310b
  • uv run pytest -v: 888 passed, 1 skipped. The 10 failures and 30 errors are Windows-only (symlinks, gh shim) and identical on unmodified integration
  • uv run mkdocs build --strict passes

Checklist

  • Commits are signed off (DCO)
  • Prose follows STYLE.md
  • No secrets, tokens, or internal URLs

Security

  • No security impact

🤖 Generated with Claude Code

@imran-siddique @claude
fix(trace): give the OCSF allow decision a structured class
ece9785 
The allow rule lived only in decision_class.description, under the old
caption "Application Activity", and neither Trace page had a row for it.
Add decision_class.allow_class with class_uid 6002, class_name
"Application Lifecycle" and the fields an allow carries, add the row to
events.md and extend_ocsf.md, and guard it in
test_trace_mapping_defaults.py. The opt-in to Detection Finding stays.

Fixes GenAI-Security-Project#198

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Imran Siddique <45405841+imran-siddique@users.noreply.github.com>
@github-project-automation github-project-automation Bot moved this to Needs triage in ACS Project Tracker Oct 15, 2026
@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

This pull request's description says it closes #198, which is on the project roadmap. When it merges, GitHub closes that issue and the roadmap counts it as delivered. Please confirm the change delivers the whole issue before merging.

@acs-board-reconciler acs-board-reconciler Bot moved this from Needs triage to In progress in ACS Project Tracker Oct 16, 2026
@imran-siddique

imran-siddique commented Oct 16, 2026

Copy link
Copy Markdown
Author

Confirmed, this delivers all of #198. Part 1: the Decision (allow) row is in both events.md and extend_ocsf.md. Part 2: allow_class in ocsf-mapping.json names the required fields, with the disposition in unmapped.acs.decision and the evaluator in unmapped.acs.metadata. One wording difference from the issue: 6002's class name is Application Lifecycle (Application Activity is its OCSF category), so the rows use the class name.

@imran-siddique

imran-siddique commented Oct 20, 2026

Copy link
Copy Markdown
Author

@rocklambros this is green and mergeable, and it delivers all of #198 as confirmed above. Could one of the code owners review it?

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rocklambros rocklambros Awaiting requested review from rocklambros rocklambros is a code owner
@fewdisc fewdisc Awaiting requested review from fewdisc fewdisc is a code owner
@GangGreenTemperTatum GangGreenTemperTatum Awaiting requested review from GangGreenTemperTatum GangGreenTemperTatum is a code owner
@mamicidal mamicidal Awaiting requested review from mamicidal mamicidal is a code owner
@sclintonowasp sclintonowasp Awaiting requested review from sclintonowasp sclintonowasp is a code owner
@afogel afogel Awaiting requested review from afogel afogel is a code owner
@bar-capsule bar-capsule Awaiting requested review from bar-capsule bar-capsule is a code owner
@stefanoamorelli stefanoamorelli Awaiting requested review from stefanoamorelli stefanoamorelli is a code owner
@almogbhl almogbhl Awaiting requested review from almogbhl almogbhl is a code owner
@artmaro artmaro Awaiting requested review from artmaro artmaro is a code owner
@Lrd0036 Lrd0036 Awaiting requested review from Lrd0036 Lrd0036 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

ACS Project Tracker
Status: In progress

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Docs] Trace events page omits the OCSF class for allow that ocsf-mapping.json defines

1 participant

@imran-siddique