Profiles in OASF

[akijakya]

What Are Profiles in OCSF?

Profiles are modular overlays that allows the addition of focused sets of attributes, to existing event classes or objects, without altering their fundamental structure or creating new classes. They are a flexible way to enrich events with additional context relevant to specific domains, environments, or technologies.

Key Points

• Overlay, Not Extension: Profiles are used to optionally overlay extra attributes onto event classes and objects. This is different from extensions, which create entirely new event classes. Profiles let you enrich core schema classes with additional, reusable context.
• Composability: Multiple profiles can be applied to a single event. For example, an event might include both the "Cloud" and "Container" profiles if it describes a process running in a container on AWS.
• Domain-Specific Context: Profiles are often used to add context for specific domains, such as cloud environments (Cloud profile), host information (Host profile), or containerization (Container profile).
• Backward Compatibility: Profiles are designed so that tools that understand them can use the extra context, but those that do not will simply ignore the additional attributes. This ensures that adding profiles does not break existing integrations or analytics.

Problem

The profiles function is currently not used in OASF - it could be useful however, once adoption grows. This discussion could be the place for proposals and recommendations about how this capability could be utilised.

[ramizpolic]

Similar to my comment on attribute groups, the profiles can also be leveraged once we have some usage-specific example. If we base this agent-specific, then profiles could indicate some examples of a fully-fledged agent with specific skills, domains, and features.

[muscariello]

What is the use case to add such complexity? When is it that you want one object to be polymorphic? OCSF barely uses profiles. I think they could be use when the usage really requires that. IMHO we're very far from that. Aren't we?

[ramizpolic]

We are indeed far from that. My suggestion was to not remove anything until we have a proper example of how to use it. Until then, we simply don't need to use profiles rather than removing them. IF we really cannot find any useful examples, then we can discuss and agree what to do.

[ramizpolic]

Same as your comment here #154 (reply in thread)