ocsf

Getting this into core OCSF

Core OCSF changes go through pull requests to ocsf/ocsf-schema. Each pull request needs three approvals, a Signed-off-by line on every commit (Developer Certificate of Origin), and a numbered entry in the Unreleased section of its CHANGELOG.md. Its CI validates the metaschema, compiles, checks backward compatibility against the last stable release, and runs an advisory reviewer on descriptions.

Stage 1: register the extension

Reserve the name and UID so nobody else takes them.

1. Fork ocsf/ocsf-schema.
2. Add a row to extensions.md with caption Fraud, name fraud, the next unused vendor UID (the registry counts down from 998; 983 was the next free value when this was written, so check again), a one-line note, and this repository’s URL.
3. Add New Extension registration for Fraud under Unreleased in CHANGELOG.md.
4. Open the pull request with the repository’s template.
5. Email info@ocsf.io from fraud@evanrkinney.com so maintainers can confirm the request.
6. If the UID you are given differs from 983, change schema/fraud/extension.json and the uid values in examples/ (class and type UIDs are derived from it).

Stage 2: open the discussion

Before proposing core changes, start a thread in OCSF Discussions and raise it in the OCSF Slack. Link the viewer and this repository, and ask the open questions in design.md: involved_parties as a core mechanism, and whether fraud frameworks belong in attacks or a separate attribute.

Stage 3: propose core changes in small pull requests

Split the work so each pull request can be reviewed on its own:

1. Objects: monetary_amount, financial_account, payment_instrument, counterparty, financial_transaction, approval, and their dictionary attributes.
2. Category and classes: the Financial Activity category and the five classes.
3. Profiles: fraud and fraud_signals, plus applying them to findings, Authentication, and User Management.
4. Findings: fraud_attacks, involved_parties, fraud_loss, loss_event_classification, regulatory_classifications.

When moving from extension to core:

• Move files from schema/fraud/ into the matching core folders and drop the fraud/ prefixes.
• Replace the patch files (events/findings/*.json, events/iam/*.json, objects/finding_info.json) with edits to the core files themselves.
• Use a core category UID agreed with maintainers; class UIDs then follow category × 1000 + uid.
• Keep every description in OCSF style: no URLs, trademarks, or vendor names outside references and <code> examples. tools/lint_descriptions.py checks this.
• Keep a “For example” in every new attribute description.

Checklist for each pull request

• tools/check.sh passes here against core main
• Core’s own CI passes on the fork
• Every commit has Signed-off-by: Your Name <email> (git commit -s)
• CHANGELOG.md entry under Unreleased, with the pull request link
• Description explains the use case with an example event