Deprecate _result attrs in lieu of updated_ convention

.github/.project-words.txt

@@ -28,6 +28,7 @@ callsign
 CASB
 CDMA
 cdxgen
+CLSID
 CMDB
 containerd
 cpid
@@ -105,6 +106,7 @@ meid
 memoizee
 metaschema
 Metaschema
+metaschemas
 minifilter
 MISP
 mklink

CHANGELOG.md

@@ -63,6 +63,7 @@ Thankyou! -->
   1. Added `updated_job` that reflects the attempted or the actual updated job. [#1597](https://github.com/ocsf/ocsf-schema/pull/1597)
   1. Added `properties` that is a set of characteristics associated with an entity. [#1597](https://github.com/ocsf/ocsf-schema/pull/1597)
   1. Added `iam_role`, `iam_roles`, `updated_role`, `updated_group`, `updated_user` attributes. [#1603](https://github.com/ocsf/ocsf-schema/pull/1603)
+  1. Added `updated_entity`, `updated_file`, `updated_resources`, and `updated_web_resources` attributes for reporting intended or actual post-update state. [#1618](https://github.com/ocsf/ocsf-schema/pull/1618)
   1. Added `initiator` and `initiator_id` attributes for identifying which endpoint initiated a network communication, with generic `Unknown (0)` and `Other (99)` enums. [#1598](https://github.com/ocsf/ocsf-schema/pull/1598)
 
 
@@ -71,6 +72,7 @@ Thankyou! -->
 * #### Event Classes
   1. Added `updated_job` in `Scheduled Job Activity` class to reflect the actual or attempted state of the job upon update activity. [#1597](https://github.com/ocsf/ocsf-schema/pull/1597)
   1. Added `iam_role` and role management support to `group_management`, `authorize_session`. Filled out the `group_management` class with complete lifecycle as well as added `resources`, `policies` to the discrete activities. [#1603](https://github.com/ocsf/ocsf-schema/pull/1603)
+  1. Added `updated_*` attributes to `Entity Management`, `File Activity`, `File Hosting`, and `Web Resources Activity` for class-specific update result reporting. [#1618](https://github.com/ocsf/ocsf-schema/pull/1618)
   1. Added `initiator_id` and `initiator` to `Network Activity` with network-specific enums `Source Endpoint (1)` and `Destination Endpoint (2)`, and updated `src_endpoint` and `dst_endpoint` descriptions to reflect bi-flow and asymmetric flow scenarios. [#1598](https://github.com/ocsf/ocsf-schema/pull/1598)
 * #### Profiles
 * #### Objects
@@ -90,7 +92,7 @@ Thankyou! -->
 * #### Observables
 * #### Platform Extensions
 * #### Dictionary Attributes
-  1. Impoved `job` object description to describe cases beyond System Activity class.
+  1. Improved `job` object description to describe cases beyond System Activity class.
 
 ### Bugfixes
 1. Fixed the static anti-pattern checker so dictionary attributes are analyzed with the full compiled dictionary; the `missing-sibling` rule no longer false-positives when the sibling exists in `dictionary.json`. [#1613](https://github.com/ocsf/ocsf-schema/pull/1613)
@@ -99,6 +101,7 @@ Thankyou! -->
 ### Deprecated
 1. Deprecated `is_src_dst_assignment_known` dictionary attribute and its usage in `Network Activity` in favour of `initiator_id`. [#1598](https://github.com/ocsf/ocsf-schema/pull/1598)
 1. Deprecated `message` attribute in the `http_response` object. The `code` and `status` attributes already convey the HTTP status code and reason phrase. [#1616](https://github.com/ocsf/ocsf-schema/pull/1616)
+1. Deprecated `entity_result`, `file_result`, `resources_result`, and `web_resources_result` in favor of the corresponding `updated_*` attributes. [#1618](https://github.com/ocsf/ocsf-schema/pull/1618)
 1. Deprecated `resource` in `Group Management` in favor of `resources`. [#1603](https://github.com/ocsf/ocsf-schema/pull/1603)
 1. Deprecated usage of `cmd_line` attribute in favor of `job_actions.cmd_line` in the `job` object. [#1597](https://github.com/ocsf/ocsf-schema/pull/1597)
 1. Deprecated usage of `last_run_time` attribute in favor of `job_triggers.last_run_time` in the `job` object. [#1597](https://github.com/ocsf/ocsf-schema/pull/1597)

dictionary.json

@@ -1399,7 +1399,7 @@
       "description": "The component of a data object. See specific usage.",
       "type": "string_t"
     },
-    "com_class_uuid": { 
+    "com_class_uuid": {
       "caption": "COM Class Identifier",
       "description": "The COM Class Identifier (CLSID).",
       "type": "uuid_t"
@@ -2533,7 +2533,11 @@
     "entity_result": {
       "caption": "Entity Result",
       "description": "The updated managed entity.",
-      "type": "managed_entity"
+      "type": "managed_entity",
+      "@deprecated": {
+        "message": "Use the <code>updated_entity</code> attribute instead.",
+        "since": "1.9.0"
+      }
     },
     "environment_variables": {
       "caption": "Environment Variables",
@@ -2753,7 +2757,11 @@
     "file_result": {
       "caption": "File Result",
       "description": "The result of the file change. It should contain the new values of the changed attributes.",
-      "type": "file"
+      "type": "file",
+      "@deprecated": {
+        "message": "Use the <code>updated_file</code> attribute instead.",
+        "since": "1.9.0"
+      }
     },
     "files": {
       "caption": "Files",
@@ -4551,7 +4559,7 @@
     },
     "original_time": {
       "caption": "Original Time",
       "description": "The original event time as reported by the event source, preserved as a pass-through string in its native format (e.g., Syslog timestamp, Windows event time). This is not normalized to <code>timestamp_t</code> &mdash; the normalized equivalent is the base event <code>time</code> attribute. Omit if the event is generated rather than collected via logs.",
       "type": "string_t"
     },
     "os": {
@@ -5296,7 +5304,7 @@
     },
     "raw_data": {
       "caption": "Raw Data",
       "description": "The original event/finding data as received from the source, before normalization into OCSF. Populate this with the verbatim log line, JSON payload, or other native format for forensic and debugging purposes. This field is not intended for structured querying &mdash; use the normalized OCSF attributes instead.",
       "type": "string_t"
     },
     "raw_data_hash": {
@@ -5551,7 +5559,11 @@
       "caption": "Resource Results Array",
       "description": "Updated resources after an activity/event.",
       "type": "resource_details",
-      "is_array": true
+      "is_array": true,
+      "@deprecated": {
+        "message": "Use the <code>updated_resources</code> attribute instead.",
+        "since": "1.9.0"
+      }
     },
     "response": {
       "caption": "API Response Details",
@@ -6927,11 +6939,32 @@
       "description": "The number of unused services. See specific usage.",
       "type": "integer_t"
     },
+    "updated_entity": {
+      "caption": "Updated Entity",
+      "description": "The updated entity. See specific usage.",
+      "type": "managed_entity"
+    },
+    "updated_file": {
+      "caption": "Updated File",
+      "description": "The updated file. See specific usage.",
+      "type": "file"
+    },
     "updated_group": {
       "caption": "Updated Group",
       "description": "The updated group. See specific usage.",
       "type": "group"
     },
+    "updated_job": {
+      "caption": "Updated Job",
+      "description": "The updated job. See specific usage.",
+      "type": "job"
+    },
+    "updated_resources": {
+      "caption": "Updated Resources",
+      "description": "The updated resources. See specific usage.",
+      "type": "resource_details",
+      "is_array": true
+    },
     "updated_role": {
       "caption": "Updated Role",
       "description": "The updated role. See specific usage.",
@@ -6942,10 +6975,11 @@
       "description": "The updated user. See specific usage.",
       "type": "user"
     },
-    "updated_job": {      
-      "caption": "Updated Job",
-      "description": "The updated job. See specific usage.",
-      "type": "job"
+    "updated_web_resources": {
+      "caption": "Updated Web Resources",
+      "description": "The updated web resources. See specific usage.",
+      "type": "web_resource",
+      "is_array": true
     },
     "uploaded_time": {
       "caption": "Uploaded Time",
@@ -7183,7 +7217,11 @@
       "caption": "Web Resources Result",
       "description": "The results of the activity on web resources. It should contain the new values of the changed attributes of the web resources.",
       "type": "web_resource",
-      "is_array": true
+      "is_array": true,
+      "@deprecated": {
+        "message": "Use the <code>updated_web_resources</code> attribute instead.",
+        "since": "1.9.0"
+      }
     },
     "whois": {
       "caption": "WHOIS",

events/application/file_hosting.json

@@ -146,6 +146,11 @@
       "description": "The endpoint that performed the activity on the target file.",
       "group": "primary",
       "requirement": "required"
+    },
+    "updated_file": {
+      "description": "The intended state of the <code>file</code> after the update, including the <code>Update</code>, <code>Rename</code>, and <code>Move</code> activities. On <code>Success</code>, represents the actual post-update state.",
+      "group": "context",
+      "requirement": "optional"
     }
   }
 }

events/application/web_resources_activity.json

@@ -69,6 +69,11 @@
       "group": "context",
       "requirement": "optional"
     },
+    "updated_web_resources": {
+      "description": "The intended state of the <code>web_resources</code> after the update. On <code>Success</code>, represents the actual post-update state.",
+      "group": "primary",
+      "requirement": "recommended"
+    },
     "web_resources": {
       "group": "primary",
       "requirement": "required"

events/iam/entity_management.json

@@ -81,6 +81,11 @@
     "entity_result": {
       "group": "primary",
       "requirement": "recommended"
+    },
+    "updated_entity": {
+      "description": "The intended state of the <code>entity</code> after the update. On <code>Success</code>, represents the actual post-update state.",
+      "group": "primary",
+      "requirement": "recommended"
     }
   }
 }

events/system/file_activity.json

@@ -100,6 +100,11 @@
       "description": "The resulting file object when the activity was allowed and successful.",
       "group": "primary",
       "requirement": "recommended"
+    },
+    "updated_file": {
+      "description": "The intended state of the <code>file</code> after the update, including the <code>Update</code>, <code>Rename</code>, <code>Set Attributes</code> and <code>Set Security</code> activities. On <code>Success</code>, represents the actual post-update state.",
+      "group": "primary",
+      "requirement": "recommended"
     }
   },
   "references": [

objects/job.json

@@ -45,7 +45,7 @@
       "requirement": "recommended"
     },
     "next_run_time": {
-      "@deprecated": { 
+      "@deprecated": {
         "message": "Use the <code>job_trigger.next_run_time</code> attribute instead.",
         "since": "1.9.0"
       },