Defaults & mappings

defaults

Consistent defaults, the class registry, and enum mappings for OCSF events.

Everything version- or product-specific lives here, so that pinning/bumping the OCSF schema version and adjusting our house defaults is a one-file change. The per-class identity registry and activity vocabularies come from the generated _catalog module.

ClassSpec dataclass

ClassSpec(
    ocsf_class: OcsfClass,
    class_uid: int,
    category_uid: int,
    class_name: str,
    category_name: str,
    model_name: str,
    action: type[IntEnum],
)

Fixed OCSF identity for one class (uids, sibling name fields, model, activity).

type_uid

type_uid(activity_id_value: int) -> int

OCSF type_uid = class_uid * 100 + activity_id.

Source code in src/ocsf_emitter/defaults.py

def type_uid(self, activity_id_value: int) -> int:
    """OCSF ``type_uid`` = class_uid * 100 + activity_id."""
    return self.class_uid * 100 + activity_id_value

Severity

Bases: Enum

Our severity vocabulary. Maps to OCSF severity_id (0,1,2..6,99).

Status

Bases: Enum

Our finding status vocabulary. Maps to OCSF status_id.

Activity

Bases: Enum

Our finding activity vocabulary (Findings classes). Maps to OCSF activity_id.

Shared by Detection Finding (2004) and Compliance Finding (2003), whose activity_id enums are identical: 1 Create, 2 Update, 3 Close.

Confidence

Bases: Enum

Our confidence vocabulary. Maps to OCSF confidence_id.

RiskLevel

Bases: Enum

Our risk-level vocabulary. Maps to OCSF risk_level_id.

class_spec

class_spec(ocsf_class: OcsfClass) -> ClassSpec

Return the :class:ClassSpec for a supported OCSF class.

Source code in src/ocsf_emitter/defaults.py

def class_spec(ocsf_class: OcsfClass) -> ClassSpec:
    """Return the :class:`ClassSpec` for a supported OCSF class."""
    return _CLASS_REGISTRY[ocsf_class]

class_spec_by_uid

class_spec_by_uid(class_uid_value: int) -> ClassSpec | None

Return the :class:ClassSpec for a class_uid int, or None if unsupported.

Source code in src/ocsf_emitter/defaults.py

def class_spec_by_uid(class_uid_value: int) -> ClassSpec | None:
    """Return the :class:`ClassSpec` for a ``class_uid`` int, or None if unsupported."""
    return _CLASS_BY_UID.get(class_uid_value)

configure_product

configure_product(
    *,
    name: str,
    vendor_name: str,
    version: str | None = None,
    uid: str | None = None,
) -> Product

Set the process-wide default Product stamped onto findings.

Call once at startup. version defaults to the pinned OCSF schema version if omitted. Returns the constructed Product for convenience.

Source code in src/ocsf_emitter/defaults.py

def configure_product(
    *,
    name: str,
    vendor_name: str,
    version: str | None = None,
    uid: str | None = None,
) -> _m.Product:
    """Set the process-wide default Product stamped onto findings.

    Call once at startup. ``version`` defaults to the pinned OCSF schema version
    if omitted. Returns the constructed Product for convenience.
    """
    global _DEFAULT_PRODUCT
    _DEFAULT_PRODUCT = make_product(name=name, vendor_name=vendor_name, version=version, uid=uid)
    return _DEFAULT_PRODUCT

make_product

make_product(
    *,
    name: str,
    vendor_name: str,
    version: str | None = None,
    uid: str | None = None,
) -> Product

Construct an OCSF Product block from our fields (does not set the default).

Source code in src/ocsf_emitter/defaults.py

def make_product(
    *,
    name: str,
    vendor_name: str,
    version: str | None = None,
    uid: str | None = None,
) -> _m.Product:
    """Construct an OCSF Product block from our fields (does not set the default)."""
    return _m.Product(
        name=name,
        vendor_name=vendor_name,
        version=version if version is not None else OCSF_SCHEMA_VERSION,
        uid=uid,
    )

default_product

default_product() -> Product | None

Return the process-wide default Product, or None if unconfigured.

Source code in src/ocsf_emitter/defaults.py

def default_product() -> _m.Product | None:
    """Return the process-wide default Product, or None if unconfigured."""
    return _DEFAULT_PRODUCT

default_metadata

default_metadata(product: Product) -> Metadata

Metadata block carrying the pinned schema version and the given product.

Source code in src/ocsf_emitter/defaults.py

def default_metadata(product: _m.Product) -> _m.Metadata:
    """Metadata block carrying the pinned schema version and the given product."""
    return _m.Metadata(product=product, version=OCSF_SCHEMA_VERSION)

severity_id

severity_id(severity: Severity) -> int

Map our Severity enum to an OCSF severity_id int.

Source code in src/ocsf_emitter/defaults.py

def severity_id(severity: Severity) -> int:
    """Map our Severity enum to an OCSF severity_id int."""
    return _SEVERITY_TO_ID[severity]

status_id

status_id(status: Status) -> int

Map our Status enum to an OCSF status_id int.

Source code in src/ocsf_emitter/defaults.py

def status_id(status: Status) -> int:
    """Map our Status enum to an OCSF status_id int."""
    return _STATUS_TO_ID[status]

activity_id

activity_id(activity: Activity) -> int

Map our Activity enum to an OCSF activity_id int.

Source code in src/ocsf_emitter/defaults.py

def activity_id(activity: Activity) -> int:
    """Map our Activity enum to an OCSF activity_id int."""
    return _ACTIVITY_TO_ID[activity]

confidence_id

confidence_id(confidence: Confidence) -> int

Map our Confidence enum to an OCSF confidence_id int.

Source code in src/ocsf_emitter/defaults.py

def confidence_id(confidence: Confidence) -> int:
    """Map our Confidence enum to an OCSF confidence_id int."""
    return _CONFIDENCE_TO_ID[confidence]

risk_level_id

risk_level_id(risk_level: RiskLevel) -> int

Map our RiskLevel enum to an OCSF risk_level_id int.

Source code in src/ocsf_emitter/defaults.py

def risk_level_id(risk_level: RiskLevel) -> int:
    """Map our RiskLevel enum to an OCSF risk_level_id int."""
    return _RISK_LEVEL_TO_ID[risk_level]

class_uid

class_uid() -> int

Return the Detection Finding class_uid (2004).

Source code in src/ocsf_emitter/defaults.py

def class_uid() -> int:
    """Return the Detection Finding class_uid (2004)."""
    return CLASS_UID

category_uid

category_uid() -> int

Return the Findings category_uid (2).

Source code in src/ocsf_emitter/defaults.py

def category_uid() -> int:
    """Return the Findings category_uid (2)."""
    return CATEGORY_UID

type_uid

type_uid(activity: Activity) -> int

Compute the Detection Finding type_uid = class_uid * 100 + activity_id.

Source code in src/ocsf_emitter/defaults.py

def type_uid(activity: Activity) -> int:
    """Compute the Detection Finding type_uid = class_uid * 100 + activity_id."""
    return TYPE_UID_BASE + _ACTIVITY_TO_ID[activity]

type_uid_int

type_uid_int(activity: Activity) -> int

Alias of :func:type_uid (kept for backward compatibility).

Source code in src/ocsf_emitter/defaults.py

def type_uid_int(activity: Activity) -> int:
    """Alias of :func:`type_uid` (kept for backward compatibility)."""
    return TYPE_UID_BASE + _ACTIVITY_TO_ID[activity]

class_identity

class_identity(
    ocsf_class: OcsfClass,
) -> tuple[int, int, str, str]

Return (class_uid, category_uid, class_name, category_name) for a class.

Source code in src/ocsf_emitter/defaults.py

def class_identity(ocsf_class: OcsfClass) -> tuple[int, int, str, str]:
    """Return ``(class_uid, category_uid, class_name, category_name)`` for a class."""
    spec = _CLASS_REGISTRY[ocsf_class]
    return spec.class_uid, spec.category_uid, spec.class_name, spec.category_name

type_uid_for

type_uid_for(
    ocsf_class: OcsfClass, activity_id_value: int
) -> int

Compute type_uid = class_uid * 100 + activity_id for a class.

Source code in src/ocsf_emitter/defaults.py

def type_uid_for(ocsf_class: OcsfClass, activity_id_value: int) -> int:
    """Compute ``type_uid = class_uid * 100 + activity_id`` for a class."""
    return _CLASS_REGISTRY[ocsf_class].type_uid(activity_id_value)

activity_id_int

activity_id_int(activity: Activity) -> int

Return the integer OCSF activity_id for a shared Findings Activity.

Source code in src/ocsf_emitter/defaults.py

def activity_id_int(activity: Activity) -> int:
    """Return the integer OCSF activity_id for a shared Findings ``Activity``."""
    return _ACTIVITY_TO_ID[activity]