Application Activity

[k2niner]

As part of the promotion of Application Category, I propose the following Application Activity class.

{
    "uid": X,
    "description": "Application Activity events describe actions executed within an Application",
    "extends": "base_event",
    "caption": "Application Activity",
    "name": "application_activity",
    "category": "application",
    "attributes": {
        "activity_id": {
            "description": "The application activity type identifier",
            "requirement": "required",
            "enum": {
                "1": {
                    "caption": "Create",
                    "description": "The application activity in the event pertains to a 'create' activity."
                },
                "2": {
                    "caption": "Read",
                    "description": "The application activity in the event pertains to a 'read' activity."
                },
                "3": {
                    "caption": "Update",
                    "description": "The application activity in the event pertains to a 'update' activity."
                },
                "4": {
                    "caption": "Delete",
                    "description": "The application activity in the event pertains to a 'delete' activity."
                },
                "5": {
                    "caption": "Search",
                    "description": "The application activity in the event pertains to a 'search' activity."
                },
                "6": {
                    "caption": "Import",
                    "description": "The application activity in the event pertains to a 'import' activity."
                },
                "7": {
                    "caption": "Export",
                    "description": "The application activity in the event pertains to a 'export' activity."
                },
                "8": {
                    "caption": "Share",
                    "description": "The application activity call in the event pertains to a 'share' activity."
                }
            }
        },
        "actor": {
            "group": "primary",
            "requirement": "required"
        },
        "src_endpoint": {
            "description": "Details about the source of the activity.",
            "group": "primary",
            "requirement": "required"
        },
        "dst_endpoint": {
            "group": "primary",
            "requirement": "recommended"
        },
        "http_request": {
            "description":"Details about the underlying http request.",
            "group": "primary",
            "requirement": "optional"
        },
        "resources": {
            "description": "Details about resources that were affected by the activity/event.",
            "group": "primary",
            "requirement": "recommended"
        },
        "resources_result": {
            "description": "Details on the resources resulting from the actvity.",
            "group": "primary",
            "requirement": "optional"
        }
    }
}

Also suggest we shift API Activity to Application as part of the promotion.

[pagbabian-splunk]

Assume we will include the standard Unknown and Other enums in the PR. For resources_result is this the post activity state of application? I'm assuming the type of resources is an array of Resource objects, but what is the type of resources_result?

[k2niner]

Correct, re: Unknown and Other. 99% of my use cases are satisfies by the resources array. With resources_result I wanted to provide a place to capture post-activity state of a resource. For consistency, I made that an array in case there were multiple resources acted upon.

[pagbabian-splunk]

Thanks. I had already voted Yes. It would be good to see an example though, I'm not clear on how one of the activities on one resource would return one or more other resources, maybe that's an edge case. If an activity was on one resource, I assume one result of the same resource could indicate what happened to that resource, and in some cases, side effects to other resources.

[odianosen]

It appears that consensus has been reached on this proposal. I'll create a PR for it.

[pagbabian-splunk]

Application Activity part of RC3.