Device types that don't fit into any of the available os.type values

[jessepw]

Summary:

Multiple device types with "operating systems" that don't fit into the 6 available os.type values have been identified by the Microsoft Defender for Endpoint (MDE) integration:

• "ESXi" - VMware ESXi is not a standard Linux, Unix, or Android operating system. Instead, it uses a unique, proprietary operating system kernel called the VMkernel, which is a type-1 or "bare-metal" hypervisor.
• "Haiku" - Haiku is not a Linux, Unix or Android operating system; it is a unique, open-source OS that is a spiritual successor to BeOS. Thus, Haiku is its own unique, ground-up implementation of an operating system inspired by the design philosophy of BeOS.
• "Integrated Lights Out Manager (ILOM)" - Oracle Integrated Lights Out Manager (ILOM) runs its own embedded operating system, separate from the server's host operating system.

Motivation:

If it's desired for events from these devices to be included in buckets/aggregations/visualizations, the os.type field shouldn't be left blank, but they don't really fit into any of the accepted values for the field.

Detailed Design:

There should be some kind of way to fit these devices into os.type, whether it's by adding each of their respective types as an accepted value for the field, or perhaps adding a value that could include all 3 of them. Given that these device types are rather obscure/rare compared to the other accepted values, would it make sense to add some kind of 'other' value to os.type? Or would there be a better way to approach this?

[mjwolf]

Hi, I think the best way to identify these OSs is to use the os.name, os.platform or os.kernel fields. The os.type definition is "broad commercial families", so I don't think these individual OSs would qualify as an OS "family".

I think there are some common family types which are missing from this list of allowed values though. We can consider adding BSD, BeOS, and maybe some others.

I don't think there would really be much value in adding an "other" type to os.family. I'm not sure if that would convey any information which would be useful, and there are other os fields, which could be used to hold more specific information about OSs.