Moving Network Proxy to a Profile

[maxhotta]

When a network proxy is involved in an event activity (of Network Activity events), the connection information from proxy to remote server should be captured (along with the existing information included in the current proxy object).
The following attributes apply to the flow from the proxy to the remote server.

• TLS details
• Connection details
• Proxy Endpoint details
• Traffic details

The proposal is to include all of these items in the Network Proxy object, and make the Network Proxy a Profile that can be selectively applied to a Network Activity event class.

{
  "description": "The attributes that identify network proxy attributes.",
  "meta": "profile",
  "caption": "Network Proxy",
  "name": "network_proxy",
  "annotations": {
    "group": "primary"
  },
  "attributes": {
    "network_proxy": {
      "requirement": "required"
    }
  }
}

{
  "caption": "Network Proxy",
  "name": "network_proxy",
  "description": "The network proxy object encapsulates details associated with the proxy endpoint and activity from the proxy to the remote server. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/'>d3f:ProxyServer</a>.",
  "extends": "network_endpoint",
  "attributes": {
    "connection_info": {
      "group": "primary",
      "requirement": "recommended"
    },
    "traffic": {
      "group": "primary",
      "requirement": "recommended"
    },
    "tls": {
      "group": "primary",
      "requirement": "recommended"
    }
  }
}