Skip to content

fix(ocsf): report the required device.os.type_id - #4677

Merged
krishicks merged 1 commit into
mainfrom
fix/2912-ocsf-os-type-id/krishicks
Oct 17, 2026
Merged

krishicks merged 1 commit into
mainfrom
fix/2912-ocsf-os-type-id/krishicks

Conversation

@krishicks

Copy link
Copy Markdown
Collaborator

Summary

OCSF 1.8 requires type_id on the os object, but every OpenShell event reported device.os with only a name, so the events weren't schema-valid. Events now include device.os.type_id and its type label.

Related Issue

Refs #2912

This is one of several PRs that together satisfy #2912, so it does not close the issue.

Changes

  • device.os reports Linux (200), Windows (100), or macOS (300). Any other platform reports Other (99), with the platform name as the type label.
  • openshell-ocsf: a new OsTypeId enum, plus type_id, the type label, and OsInfo::for_target on OsInfo. Sandbox and gateway devices all build their OS info through for_target.
  • The OCSF 1.8.0 os object schema is now vendored, so tests validate device.os. It was missing before, which is why the omission wasn't caught.
  • Docs: ocsf-json-export.mdx describes device.os.type_id and updates the example record.

Before:

"os": { "name": "Linux" }

After:

"os": { "name": "Linux", "type_id": 200, "type": "Linux" }

Testing

  • cargo nextest run -p openshell-ocsf -p openshell-otel -p openshell-server (2600 passed)
  • cargo clippy --workspace --all-targets -- -D warnings
  • Unit tests added: OS type mapping per platform, and validation of every device's os against the vendored schema
  • E2E tests added/updated (not applicable)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

OCSF 1.8 requires type_id on the os object, but device.os carried only
a name. Events now report Linux (200), Windows (100), macOS (300), or
Other (99) with the platform name as the type label. The os object
schema is vendored so tests validate it.

Refs #2912

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@github-actions

Copy link
Copy Markdown

@krishicks
krishicks added this pull request to the merge queue Oct 17, 2026
Merged via the queue into main with commit fdfbf84 Oct 17, 2026
82 checks passed
@krishicks
krishicks deleted the fix/2912-ocsf-os-type-id/krishicks branch October 17, 2026 01:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants