Enhance Traffic Object to clarify how bytes have been counted (headers vs. data)

CHANGELOG.md

@@ -64,6 +64,7 @@ Thankyou! -->
   1. Added `icmp_type`, `icmp_code` and `icmp_uid` attributes. [#1719](https://github.com/ocsf/ocsf-schema/pull/1719)
   1. Added `audience` as a `string_t`, with `source` set to the `aud` claim and a reference to RFC 7519. [#1705](https://github.com/ocsf/ocsf-schema/pull/1705)
   1. Added `ai_status`, `permission_result`, `permission_result_id`, `stop_reason`, and `stop_reason_id` attributes. [#1704](https://github.com/ocsf/ocsf-schema/pull/1704)
+  1. Added `data_bytes`, `data_bytes_in` and `data_bytes_out` attributes. [#1775](https://github.com/ocsf/ocsf-schema/pull/1775)
 
 ### Improved
 * #### Categories
@@ -87,6 +88,7 @@ Thankyou! -->
   1. Added `type_id`, `type` to `related_events` to distinguish activities, alerts, or findings as the type of the related event. [#1744](https://github.com/ocsf/ocsf-schema/pull/1744)
   1. Added `log_facility` and `log_facility_id` to the `metadata` and `logger` objects. [#1720](https://github.com/ocsf/ocsf-schema/pull/1720)
   1. Added `icmp_type`, `icmp_code` and `icmp_uid` to the `network_connection_info` object. [#1719](https://github.com/ocsf/ocsf-schema/pull/1719)
+  1. Added `data_bytes`, `data_bytes_in` and `data_bytes_out` to the `network_traffic` object, counting the data carried by the Layer 4 (Transport Layer) protocol, excluding the IP and transport headers, and clarified that its `bytes`, `bytes_in`, `bytes_out` and `bytes_missed` count bytes in Layer 3 (Network Layer) packets, including IP header and payload. [#1775](https://github.com/ocsf/ocsf-schema/pull/1775)
   1. Added per-node authority attributes `scopes`, `audience`, and `expiration_time` to the `delegation` object, so each hop in the chain of authority records what was granted, for whom, and until when. [#1705](https://github.com/ocsf/ocsf-schema/pull/1705)
 * #### Observables
 * #### Platform Extensions

dictionary.json

@@ -2046,6 +2046,21 @@
       "description": "The additional data that is associated with the event or object. See specific usage.",
       "type": "json_t"
     },
+    "data_bytes": {
+      "caption": "Total Data Bytes",
+      "description": "The total number of data bytes (in and out). Counts the data carried by the Layer 4 (Transport Layer) protocol, excluding the IP header and the transport header (such as TCP, UDP, etc.). Not applicable to protocols carried directly over IP without a transport header, such as ICMP, ICMPv6, IGMP, GRE, ESP and OSPF: leave it unset for those flows, whose bytes are counted by <code>bytes</code>, <code>bytes_in</code> and <code>bytes_out</code>.",
+      "type": "long_t"
+    },
+    "data_bytes_in": {
+      "caption": "Data Bytes In",
+      "description": "The number of data bytes sent from the destination to the source. Counts the data carried by the Layer 4 (Transport Layer) protocol, excluding the IP header and the transport header (such as TCP, UDP, etc.). Not applicable to protocols carried directly over IP without a transport header, such as ICMP, ICMPv6, IGMP, GRE, ESP and OSPF: leave it unset for those flows, whose bytes are counted by <code>bytes</code>, <code>bytes_in</code> and <code>bytes_out</code>.",
+      "type": "long_t"
+    },
+    "data_bytes_out": {
+      "caption": "Data Bytes Out",
+      "description": "The number of data bytes sent from the source to the destination. Counts the data carried by the Layer 4 (Transport Layer) protocol, excluding the IP header and the transport header (such as TCP, UDP, etc.). Not applicable to protocols carried directly over IP without a transport header, such as ICMP, ICMPv6, IGMP, GRE, ESP and OSPF: leave it unset for those flows, whose bytes are counted by <code>bytes</code>, <code>bytes_in</code> and <code>bytes_out</code>.",
+      "type": "long_t"
+    },
     "data_classification": {
       "caption": "Data Classification",
       "description": "The Data Classification object includes information about data classification levels and data category types.",

objects/network_traffic.json

@@ -5,19 +5,19 @@
   "name": "network_traffic",
   "attributes": {
     "bytes": {
-      "description": "The total number of bytes transferred in both directions (sum of bytes_in and bytes_out).",
+      "description": "The total number of bytes transferred in both directions (sum of bytes_in and bytes_out). Counts bytes in Layer 3 (Network Layer) packets, including IP header and payload.",
       "requirement": "recommended"
     },
     "bytes_in": {
-      "description": "The number of bytes sent from the destination to the source (inbound direction).",
+      "description": "The number of bytes sent from the destination to the source. Counts bytes in Layer 3 (Network Layer) packets, including IP header and payload.",
       "requirement": "optional"
     },
     "bytes_missed": {
-      "description": "The number of bytes that were missed during observation, typically due to packet loss or sampling limitations.",
+      "description": "The number of bytes that were missed during observation, typically due to packet loss or sampling limitations. Counts bytes in Layer 3 (Network Layer) packets, including IP header and payload.",
       "requirement": "optional"
     },
     "bytes_out": {
-      "description": "The number of bytes sent from the source to the destination (outbound direction).",
+      "description": "The number of bytes sent from the source to the destination. Counts bytes in Layer 3 (Network Layer) packets, including IP header and payload.",
       "requirement": "optional"
     },
     "chunks": {
@@ -32,6 +32,18 @@
       "description": "The number of chunks sent from the source to the destination (outbound direction).",
       "requirement": "optional"
     },
+    "data_bytes": {
+      "description": "The total number of data bytes transferred in both directions (sum of data_bytes_in and data_bytes_out). Counts the data carried by the Layer 4 (Transport Layer) protocol, excluding the IP header and the transport header (such as TCP, UDP, etc.). Not applicable to protocols carried directly over IP without a transport header, such as ICMP, ICMPv6, IGMP, GRE, ESP and OSPF: leave it unset for those flows, whose bytes are counted by <code>bytes</code>, <code>bytes_in</code> and <code>bytes_out</code>.",
+      "requirement": "optional"
+    },
+    "data_bytes_in": {
+      "description": "The number of data bytes sent from the destination to the source. Counts the data carried by the Layer 4 (Transport Layer) protocol, excluding the IP header and the transport header (such as TCP, UDP, etc.). Not applicable to protocols carried directly over IP without a transport header, such as ICMP, ICMPv6, IGMP, GRE, ESP and OSPF: leave it unset for those flows, whose bytes are counted by <code>bytes</code>, <code>bytes_in</code> and <code>bytes_out</code>.",
+      "requirement": "optional"
+    },
+    "data_bytes_out": {
+      "description": "The number of data bytes sent from the source to the destination. Counts the data carried by the Layer 4 (Transport Layer) protocol, excluding the IP header and the transport header (such as TCP, UDP, etc.). Not applicable to protocols carried directly over IP without a transport header, such as ICMP, ICMPv6, IGMP, GRE, ESP and OSPF: leave it unset for those flows, whose bytes are counted by <code>bytes</code>, <code>bytes_in</code> and <code>bytes_out</code>.",
+      "requirement": "optional"
+    },
     "end_time": {
       "description": "The end time of the observation or reporting period.",
       "requirement": "optional"