-
Notifications
You must be signed in to change notification settings - Fork 14
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
New CAEP event - Risk level change event #205
base: main
Are you sure you want to change the base?
Conversation
Risk level change event
|
||
A vendor may deploy mechanisms to gather and analyze various signals associated with subjects such as users, devices, etc. These signals, which can originate from diverse channels and methods beyond the scope of this event description, are processed to derive an abstracted risk level representing the subject's current threat status. | ||
|
||
The Risk Level Change event is employed by the Trasnmitter to communicate any modifications in a subject's assessed risk level at the time indicated by the `event_timestamp` field in the Risk Level Change event. The Transmitter may generate this event to indicate: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The Risk Level Change event is employed by the Trasnmitter to communicate any modifications in a subject's assessed risk level at the time indicated by the `event_timestamp` field in the Risk Level Change event. The Transmitter may generate this event to indicate: | |
The Risk Level Change event is employed by the Transmitter to communicate any modifications in a subject's assessed risk level at the time indicated by the `event_timestamp` field in the Risk Level Change event. The Transmitter may generate this event to indicate: |
### Event Specific Claims {#risk-level-change-event-specific-claims} | ||
The following optional claims MAY be present in a Session Presented event: | ||
|
||
reason_admin |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it is a mistake to make this optional field required and to use it for passing important info about the event.
|
||
### Event Specific Claims {#risk-level-change-event-specific-claims} | ||
The following optional claims MAY be present in a Session Presented event: | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could we add a field that describes the type of risk? You mention in your example user risk and device risk. What if we had a field called risk_type
whose values were an enum:
- DEVICE
- USER
- ACCOUNT
- OTHER
There may be other values that we should include in this enum as well.
New CAEP event - Risk level change event
Closes #200
Removed
ips
claim from the event and created #201 to handle it separately for all CAEP events