fix(base-event): Add StatusID (#12)

py_ocsf_models/events/base_event.py

@@ -38,13 +38,11 @@ class SeverityID(IntEnum):
 
 class StatusID(IntEnum):
     """
-    The normalized status identifier of the Finding, set by the consumer.
+    The normalized identifier of the event status.
 
     0 Unknown: The status is unknown.
-    1 New: The Finding is new and yet to be reviewed.
-    2 InProgress: The Finding is under review.
-    3 Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed.
-    4 Resolved: The Finding was reviewed, remediated and is now considered resolved.
+    1 Success
+    2 Failure
     99 Other: The event status is not mapped. See the status attribute, which contains a data source specific value.
     """
 

py_ocsf_models/events/findings/detection_finding.py

@@ -90,6 +90,28 @@ class TypeID(IntEnum):
     Other: int = 200404
 
 
+class StatusID(IntEnum):
+    """
+    The normalized identifier of the event/finding severity.
+
+    The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.
+
+    0 Unknown: The status is unknown.
+    1 New: The Finding is new and yet to be reviewed.
+    2 InProgress: The Finding is under review.
+    3 Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed.
+    4 Resolved: The Finding was reviewed, remediated and is now considered resolved.
+    99 Other: The event status is not mapped. See the status attribute, which contains a data source specific value.
+    """
+
+    Unknown: int = 0
+    New: int = 1
+    InProgress: int = 2
+    Suppressed: int = 3
+    Resolved: int = 4
+    Other: int = 99
+
+
 class DetectionFinding(Finding, BaseModel):
     """
     A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the security_control profile should be applied and its attacks information should be duplicated into the finding_info object.
@@ -146,6 +168,7 @@ class DetectionFinding(Finding, BaseModel):
     risk_level: Optional[str]
     risk_level_id: Optional[RiskLevelID]
     risk_score: Optional[int]
+    status_id: Optional[StatusID]  # type: ignore
     timezone_offset: Optional[int]
     type_uid: TypeID
     type_name: Optional[str]