Consistent defaults and enum mappings for OCSF Detection Findings.
Everything version- or product-specific lives here, so that pinning/bumping the
OCSF schema version and adjusting our house defaults is a one-file change.
Bases: Enum
Our severity vocabulary. Maps to OCSF severity_id (0,1,2..6,99).
Bases: Enum
Our finding status vocabulary. Maps to OCSF status_id.
Bases: Enum
Our finding activity vocabulary. Maps to OCSF activity_id.
Bases: Enum
Our confidence vocabulary. Maps to OCSF confidence_id.
Bases: Enum
Our risk-level vocabulary. Maps to OCSF risk_level_id.
configure_product(
*,
name: str,
vendor_name: str,
version: str | None = None,
uid: str | None = None,
) -> Product
Set the process-wide default Product stamped onto findings.
Call once at startup. version defaults to the pinned OCSF schema version
if omitted. Returns the constructed Product for convenience.
Source code in src/ocsf_emitter/defaults.py
| def configure_product(
*,
name: str,
vendor_name: str,
version: str | None = None,
uid: str | None = None,
) -> _m.Product:
"""Set the process-wide default Product stamped onto findings.
Call once at startup. ``version`` defaults to the pinned OCSF schema version
if omitted. Returns the constructed Product for convenience.
"""
global _DEFAULT_PRODUCT
_DEFAULT_PRODUCT = make_product(name=name, vendor_name=vendor_name, version=version, uid=uid)
return _DEFAULT_PRODUCT
|
make_product(
*,
name: str,
vendor_name: str,
version: str | None = None,
uid: str | None = None,
) -> Product
Construct an OCSF Product block from our fields (does not set the default).
Source code in src/ocsf_emitter/defaults.py
| def make_product(
*,
name: str,
vendor_name: str,
version: str | None = None,
uid: str | None = None,
) -> _m.Product:
"""Construct an OCSF Product block from our fields (does not set the default)."""
return _m.Product(
name=name,
vendor_name=vendor_name,
version=version if version is not None else OCSF_SCHEMA_VERSION,
uid=uid,
)
|
default_product() -> Product | None
Return the process-wide default Product, or None if unconfigured.
Source code in src/ocsf_emitter/defaults.py
| def default_product() -> _m.Product | None:
"""Return the process-wide default Product, or None if unconfigured."""
return _DEFAULT_PRODUCT
|
default_metadata(product: Product) -> Metadata
Metadata block carrying the pinned schema version and the given product.
Source code in src/ocsf_emitter/defaults.py
| def default_metadata(product: _m.Product) -> _m.Metadata:
"""Metadata block carrying the pinned schema version and the given product."""
return _m.Metadata(product=product, version=OCSF_SCHEMA_VERSION)
|
severity_id(severity: Severity) -> SeverityId
Map our Severity enum to an OCSF severity_id enum member.
Source code in src/ocsf_emitter/defaults.py
| def severity_id(severity: Severity) -> _m.SeverityId:
"""Map our Severity enum to an OCSF severity_id enum member."""
return _m.SeverityId(_SEVERITY_TO_ID[severity])
|
status_id(status: Status) -> StatusId
Map our Status enum to an OCSF status_id enum member.
Source code in src/ocsf_emitter/defaults.py
| def status_id(status: Status) -> _m.StatusId:
"""Map our Status enum to an OCSF status_id enum member."""
return _m.StatusId(_STATUS_TO_ID[status])
|
activity_id(activity: Activity) -> ActivityId
Map our Activity enum to an OCSF activity_id enum member.
Source code in src/ocsf_emitter/defaults.py
| def activity_id(activity: Activity) -> _m.ActivityId:
"""Map our Activity enum to an OCSF activity_id enum member."""
return _m.ActivityId(_ACTIVITY_TO_ID[activity])
|
confidence_id(confidence: Confidence) -> ConfidenceId
Map our Confidence enum to an OCSF confidence_id enum member.
Source code in src/ocsf_emitter/defaults.py
| def confidence_id(confidence: Confidence) -> _m.ConfidenceId:
"""Map our Confidence enum to an OCSF confidence_id enum member."""
return _m.ConfidenceId(_CONFIDENCE_TO_ID[confidence])
|
risk_level_id(risk_level: RiskLevel) -> RiskLevelId
Map our RiskLevel enum to an OCSF risk_level_id enum member.
Source code in src/ocsf_emitter/defaults.py
| def risk_level_id(risk_level: RiskLevel) -> _m.RiskLevelId:
"""Map our RiskLevel enum to an OCSF risk_level_id enum member."""
return _m.RiskLevelId(_RISK_LEVEL_TO_ID[risk_level])
|
Return the OCSF class_uid enum member for Detection Finding (2004).
Source code in src/ocsf_emitter/defaults.py
| def class_uid() -> _m.ClassUid:
"""Return the OCSF class_uid enum member for Detection Finding (2004)."""
return _m.ClassUid(CLASS_UID)
|
category_uid() -> CategoryUid
Return the OCSF category_uid enum member for Findings (2).
Source code in src/ocsf_emitter/defaults.py
| def category_uid() -> _m.CategoryUid:
"""Return the OCSF category_uid enum member for Findings (2)."""
return _m.CategoryUid(CATEGORY_UID)
|
Compute OCSF type_uid enum member = class_uid * 100 + activity_id.
Source code in src/ocsf_emitter/defaults.py
| def type_uid(activity: Activity) -> _m.TypeUid:
"""Compute OCSF type_uid enum member = class_uid * 100 + activity_id."""
return _m.TypeUid(TYPE_UID_BASE + _ACTIVITY_TO_ID[activity])
|
Return the integer type_uid value (for invariant checks/logging).
Source code in src/ocsf_emitter/defaults.py
| def type_uid_int(activity: Activity) -> int:
"""Return the integer type_uid value (for invariant checks/logging)."""
return TYPE_UID_BASE + _ACTIVITY_TO_ID[activity]
|