Extensions seem reserved but not publicly available

[nathan-bowman]

Maybe I'm missing something, but the reserved extensions here don't point you to any public repo of them?

For example, I'm looking to investigate the s1 extension. I see that it was added and they have a branch called s1-extension but they don't actually publish it.

Apparently "In order to reserve an ID space, and make your extension public..." is not enforced: https://github.com/ocsf/ocsf-schema/blob/main/CONTRIBUTING.md#reserve-a-uid-and-name-for-your-extension

In my opinion, in order for an extension ID to be granted, there needs to be a requirement to publish the actual extension.

[s-Fl]

Maybe I'm missing something, but the reserved extensions here don't point you to any public repo of them?

For example, I'm looking to investigate the s1 extension. I see that it was added and they have a branch called s1-extension but they don't actually publish it.

According to this article, contributors aren't obliged to make extensions publicly available:

The uid and version are arbitrary here. For a real extension, you should request a unique extension ID via a Pull Request to the ocsf-schema repository. This prevents collisions with other extensions. Note that having a reserved public extension ID does not mean your actual extensions need be made public.

[nathan-bowman]

Note that having a reserved public extension ID does not mean your actual extensions need be made public.

I can understand that if an org creates an extension for internal use, they wouldn't be obliged to publish it.

However, SentinelOne is claiming that their telemetry is OCSF, but you have no way of properly validating it.

ie. /api/v2/validate endpoint

{
  "error_count": 1,
  "errors": [
    {
      "attribute": "class_uid",
      "attribute_path": "class_uid",
      "error": "attribute_required_missing",
      "message": "Required attribute \"class_uid\" is missing."
    }
  ],
  "warning_count": 0,
  "warnings": []
}