Web Resource Object

[k2niner]

This is a 3-part proposal. I was going to try and capture in 1 or 2 proposals but it looked like it would be too much.

Part 1. Create Web Resource Object. This is intended to be the target of web resource activity, not a descriptor as has been discussed with resource. In D3FEND, "Web Resource" is synonymous with "Web File Resource" - A web resource is a resource identified by a Uniform Resource Identifier (URI) and made available from one host to another host via a web protocol and across a network or networks.

{
    "description": "Describes the Web Resource that was affected by the activity/event.",
    "caption": "Web Resource",
    "name": "web_resource",
    "extends": "entity",
    "attributes": {
      "data": {
        "description": "Description of the web resource.",
        "requirement": "optional"
      },
      "details": {
        "description": "Additional details describing the web resource.",
        "requirement": "optional"
      },
      "url": {
        "description": "The URL pointing towards the source of the resource.",
        "requirement": "required"
      },
      "web_resource_type": {
        "description": "The web resource type as defined by the event source.",
        "requirement": "optional"
    }
  }
}

[pagbabian-splunk]

My only comment in support is that if the object has a name and uid it should likely extend entity rather than directly extend object.

[odianosen]

To me, file and search don't seem a right fit in this object, and their presence could be confusing. Are they mutually exclusive? Can a Web Resource be of type file and have search details? Or vice versa? And why have attributes for those types specifically, out of all possible other types (like group, web page, etc)?
I would leave out those fields, and instead use the data field to populate details of the web resource (whether that be file details, search results, or something else).

Should src_url be renamed to simply url? I'm assuming it is the url of the web resource.

[k2niner]

1. Changed to extend entity. Accordingly, I removed name and uid.

2. Replaced src_url with the url object. The object comes with a bit of extra baggage but for the sake of completeness, its probably best.

3. Removed search and name objects per conversation with @odianosen. Those will be captured in the data (json) attribute

[pagbabian-splunk]

web_resource is now an object in RC3.