Remove original from the User Agent field (and replace with what?)

[oshezaf]

OSSEM-CDM/schemas/entities/user_agent.yml

Line 9 in dacbc88

- name: original

As a reminder, in one of our recent discussions we decided to remove the suffix original from this and similar headers. This is challenging for User Agent as it is defined as an entity and "original" is essentially the field name. Maybe having UA as an entity rather than an HTTP attribute is the culprit?

[neu5ron]

user agent, since is a part of multiple types of (for the sake of this conversion using the word) Entity/logs.
SIP
HTTP
QUIC
etc..
I believe moving it under HTTP would result in losing the relationship/pivoting aspect of user agent.
@oshezaf @Cyb3rWard0g thoughts?

[oshezaf]

I personally don't take user agent to be an entity. It is an attribute, potentially of different entities. That said, the OSSEM paradigm is that everything is entities and I guess I will have to adjust.

That said, it leaves us with a unique challenge here, as user agent has just one attribute, and using "original" forces a specific use for it. I guess that it has to be renamed to just "name", or something more generic.

@Cyb3rWard0g , @neu5ron

[neu5ron]

@oshezaf we can just make it user_agent same concept as a url. Does that work?

cc: @Cyb3rWard0g thoughts?