[aeilot]

Move supervisor attribution to device.container and gateway attribution to resources or unmapped. Remove the top-level container validation exemption and cover exported schemas, gateway profiles, and runtime JSONL attribution.

Refs #4915

Signed-off-by: Louis Deng louisaeilotd@gmail.com

Summary

Fix sandbox-associated OCSF records being rejected by strict OCSF 1.8.0 consumers because of the undefined top-level container attribute. Preserve sandbox identity in schema-defined fields and validate the complete records without a container exemption.

Related Issue

Closes #4915

Changes

• Move supervisor sandbox identity to device.container and declare the container profile.
• Keep gateway host identity in device. Use sandbox resources entries for API Activity and Detection Finding, and unmapped for other applicable gateway classes. Authentication records do not attach a sandbox container.
• Set Docker and Podman image.uid from the resolved workload image ID, retaining the requested reference in image.name. Omit image when no resolved UID is available.
• Remove the top-level container allowance from openshell-ocsf-validate, following the validator replacement in feat(ocsf): validate OCSF events against exported JSON Schemas #5019.
• Add schema exports and regression coverage, and document the new attribution paths.

Kubernetes image enrichment remains a follow-up, as agreed in the issue. Kubernetes records omit image while retaining sandbox identity.

Release Notes

Sandbox attribution paths have changed:

• Supervisor: device.container.uid and device.container.name.
• Gateway API Activity and Detection Finding: resources entries with type: "sandbox".
• Other applicable gateway classes: unmapped.sandbox_id and unmapped.sandbox_name.

SIEM parsers using top-level container.uid or container.name must update their mappings.

The new shape is finalized for review. As discussed in the issue, maintainers will coordinate with the XSIAM content pack maintainer before shipping; that notification remains outstanding.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated
• E2E tests added/updated

After synchronizing with upstream main:

• 1,599 component tests passed; 4 ignored.
• 33 gateway OCSF tests and 1 SPIFFE JWT integration test passed.
• Clippy, Rust formatting, and Cargo lockfile alignment passed.
• Docker ocsf_console passed using rebuilt runtime images.
• Podman ocsf_jsonl_conformance passed, validating real supervisor JSONL, sandbox attribution, and the resolved workload image UID.

Thirty synthetic records also passed the official OCSF 1.8 validator with zero errors. This online validation is separate from the real JSONL validation performed by the Podman E2E test.

Documentation validation reported zero errors and three warnings: MDX parsing on the unchanged gateway configuration page, redirect checking skipped without authentication, and theme contrast.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant supervisor and OCSF documentation updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[aeilot]

I have read the DCO document and I hereby sign the DCO.

[aeilot]

recheck