Repository navigation
fix(ocsf): report the required device.os.type_id - #4677
Merged
Merged
Conversation
OCSF 1.8 requires type_id on the os object, but device.os carried only a name. Events now report Linux (200), Windows (100), macOS (300), or Other (99) with the platform name as the type label. The os object schema is vendored so tests validate it. Refs #2912 Signed-off-by: Kris Hicks <khicks@nvidia.com>
|
🌿 Preview your docs: https://nvidia-preview-pr-4677.docs.buildwithfern.com/openshell |
TaylorMutch
approved these changes
Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OCSF 1.8 requires
type_idon theosobject, but every OpenShell event reporteddevice.oswith only aname, so the events weren't schema-valid. Events now includedevice.os.type_idand itstypelabel.Related Issue
Refs #2912
This is one of several PRs that together satisfy #2912, so it does not close the issue.
Changes
device.osreports Linux (200), Windows (100), or macOS (300). Any other platform reports Other (99), with the platform name as thetypelabel.OsTypeIdenum, plustype_id, thetypelabel, andOsInfo::for_targetonOsInfo. Sandbox and gateway devices all build their OS info throughfor_target.osobject schema is now vendored, so tests validatedevice.os. It was missing before, which is why the omission wasn't caught.ocsf-json-export.mdxdescribesdevice.os.type_idand updates the example record.Before:
After:
Testing
cargo nextest run -p openshell-ocsf -p openshell-otel -p openshell-server(2600 passed)cargo clippy --workspace --all-targets -- -D warningsosagainst the vendored schemaChecklist