Skip to content

Commit 2ef0f71

Browse files
mdhellermdheller
committed
Add canonical event JSON schema
1 parent f91ccad commit 2ef0f71

1 file changed

Lines changed: 208 additions & 0 deletions

File tree

‎schemas/sourceos-event.schema.json‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://sourceos.dev/schemas/sourceos-event.schema.json",
4+
"title": "SourceOS Canonical Event",
5+
"type": "object",
6+
"required": [
7+
"schema_version",
8+
"event_id",
9+
"event_class",
10+
"lane",
11+
"severity",
12+
"outcome",
13+
"created_at",
14+
"host",
15+
"actor",
16+
"causality",
17+
"subject",
18+
"privacy",
19+
"operator_narrative",
20+
"sync"
21+
],
22+
"additionalProperties": true,
23+
"properties": {
24+
"schema_version": { "const": "sourceos.event.v0.1" },
25+
"event_id": { "type": "string", "pattern": "^evt_[A-Za-z0-9._:-]+$" },
26+
"event_class": {
27+
"type": "string",
28+
"enum": [
29+
"process.exec",
30+
"process.exit",
31+
"policy.decision",
32+
"trust.evaluation",
33+
"telemetry.coalesced",
34+
"operator.narrative",
35+
"sync.replication",
36+
"object.repair",
37+
"schema.validation",
38+
"agent.action",
39+
"power.wake",
40+
"power.sleep",
41+
"network.keepalive",
42+
"identity.reconciled",
43+
"service.lifecycle",
44+
"app.identity_mismatch",
45+
"parser.worker",
46+
"incident.bundle"
47+
]
48+
},
49+
"lane": {
50+
"type": "string",
51+
"enum": [
52+
"security",
53+
"policy",
54+
"process_lifecycle",
55+
"identity",
56+
"trust",
57+
"package_provenance",
58+
"sync",
59+
"developer_diagnostics",
60+
"hardware_ui",
61+
"analytics",
62+
"power",
63+
"network",
64+
"parser",
65+
"product_identity",
66+
"incident"
67+
]
68+
},
69+
"severity": { "type": "string", "enum": ["trace", "debug", "info", "notice", "warning", "error", "critical"] },
70+
"outcome": {
71+
"type": "string",
72+
"enum": ["allowed", "blocked_expected", "blocked_unexpected", "blocked_attack_like", "degraded", "failed", "repaired", "observed"]
73+
},
74+
"created_at": { "type": "string", "format": "date-time" },
75+
"observed_at_monotonic_ns": { "type": ["integer", "null"], "minimum": 0 },
76+
"host": {
77+
"type": "object",
78+
"required": ["host_id", "platform", "privacy_zone"],
79+
"additionalProperties": true,
80+
"properties": {
81+
"host_id": { "type": "string" },
82+
"platform": { "type": "string" },
83+
"kernel": { "type": ["string", "null"] },
84+
"privacy_zone": { "type": "string", "enum": ["public_summary", "user_private", "admin_forensic", "sealed_secret"] }
85+
}
86+
},
87+
"actor": {
88+
"type": "object",
89+
"required": ["actor_id", "actor_type", "display_name"],
90+
"additionalProperties": true,
91+
"properties": {
92+
"actor_id": { "type": "string" },
93+
"actor_type": { "type": "string", "enum": ["process", "agent", "user", "service", "kernel", "policy_engine"] },
94+
"display_name": { "type": "string" },
95+
"uid": { "type": ["string", "integer", "null"] },
96+
"session_id": { "type": ["string", "null"] },
97+
"authority_domain": { "type": ["string", "null"] }
98+
}
99+
},
100+
"causality": {
101+
"type": "object",
102+
"required": ["root_event_id", "trace_id"],
103+
"additionalProperties": true,
104+
"properties": {
105+
"parent_event_id": { "type": ["string", "null"] },
106+
"root_event_id": { "type": "string" },
107+
"span_id": { "type": ["string", "null"] },
108+
"trace_id": { "type": "string" }
109+
}
110+
},
111+
"subject": {
112+
"type": "object",
113+
"required": ["type", "id", "display"],
114+
"additionalProperties": true,
115+
"properties": {
116+
"type": {
117+
"type": "string",
118+
"enum": ["process", "file", "socket", "ipc_service", "object", "schema", "replica", "policy", "power_state", "network_endpoint", "service", "application", "parser", "incident"]
119+
},
120+
"id": { "type": "string" },
121+
"display": { "type": "string" }
122+
}
123+
},
124+
"decision": {
125+
"type": "object",
126+
"additionalProperties": true,
127+
"properties": {
128+
"decision_id": { "type": "string" },
129+
"policy_bundle": { "type": "string" },
130+
"policy_rule": { "type": "string" },
131+
"operation": { "type": "string" },
132+
"target_class": { "type": "string" },
133+
"result": { "type": "string", "enum": ["allow", "deny", "defer", "audit"] },
134+
"semantic_outcome": { "type": "string", "enum": ["allowed", "blocked_expected", "blocked_unexpected", "blocked_attack_like", "degraded", "failed"] },
135+
"explanation_code": { "type": "string" }
136+
}
137+
},
138+
"trust": {
139+
"type": "object",
140+
"additionalProperties": true,
141+
"properties": {
142+
"mode": { "type": "string", "enum": ["local_first", "remote_allowed", "remote_required", "offline"] },
143+
"signature_state": { "type": "string", "enum": ["valid", "unsigned", "ad_hoc", "unknown", "invalid", "not_applicable"] },
144+
"package_origin": { "type": "string", "enum": ["package_manager", "system", "user_local", "container", "remote", "unknown"] },
145+
"content_hash": { "type": ["string", "null"] },
146+
"attestation_state": { "type": "string", "enum": ["verified", "degraded", "missing", "failed", "not_applicable"] },
147+
"network_lookup": { "type": "string", "enum": ["not_attempted", "blocked_by_policy", "allowed", "failed", "succeeded"] }
148+
}
149+
},
150+
"noise_control": {
151+
"type": "object",
152+
"additionalProperties": true,
153+
"properties": {
154+
"event_fingerprint": { "type": "string" },
155+
"first_seen": { "type": "string", "format": "date-time" },
156+
"last_seen": { "type": "string", "format": "date-time" },
157+
"count": { "type": "integer", "minimum": 1 },
158+
"suppressed_count": { "type": "integer", "minimum": 0 },
159+
"coalesce_window_ms": { "type": "integer", "minimum": 0 }
160+
}
161+
},
162+
"privacy": {
163+
"type": "object",
164+
"required": ["tier", "redaction_policy"],
165+
"additionalProperties": true,
166+
"properties": {
167+
"tier": { "type": "string", "enum": ["public_summary", "user_private", "admin_forensic", "sealed_secret"] },
168+
"redaction_policy": { "type": "string", "enum": ["preserve_causality", "hash_sensitive_fields", "sealed_local_only"] },
169+
"secret_fields": { "type": "array", "items": { "type": "string" } }
170+
}
171+
},
172+
"evidence": {
173+
"type": "array",
174+
"items": {
175+
"type": "object",
176+
"required": ["evidence_id", "source", "summary"],
177+
"additionalProperties": true,
178+
"properties": {
179+
"evidence_id": { "type": "string" },
180+
"source": { "type": "string" },
181+
"raw_ref": { "type": ["string", "null"] },
182+
"summary": { "type": "string" }
183+
}
184+
}
185+
},
186+
"operator_narrative": {
187+
"type": "object",
188+
"required": ["summary", "risk", "why", "next_action"],
189+
"additionalProperties": true,
190+
"properties": {
191+
"summary": { "type": "string" },
192+
"risk": { "type": "string", "enum": ["none", "low", "medium", "high", "critical", "unknown"] },
193+
"why": { "type": "string" },
194+
"next_action": { "type": "string" }
195+
}
196+
},
197+
"sync": {
198+
"type": "object",
199+
"required": ["replication_policy", "retention_class", "exportable"],
200+
"additionalProperties": true,
201+
"properties": {
202+
"replication_policy": { "type": "string", "enum": ["local_only", "private_mesh", "org_controlled", "public_demo"] },
203+
"retention_class": { "type": "string", "enum": ["ephemeral", "standard", "forensic", "sealed"] },
204+
"exportable": { "type": "boolean" }
205+
}
206+
}
207+
}
208+
}

0 commit comments

Comments
 (0)