FAQ Suggestion: Using Extensions vs Profiles

[mikeradka]

A topic of discussion that often comes up from OCSF adopters is "When should I use/create an Extension versus when should I use/create a Profile. The Understanding OCSF document does a pretty good job of explaining the two, but I think adopters still run in to problems where they are not sure the correct approach to take under various scenarios. Perhaps we can add a few scenarios where we can outline when it is appropriate to choose a Profile and when it is appropriate to choose an Extension?

[pagbabian-splunk]

Yes, we can do that and it is likely to help. Of course there is no single 'best' way and the assumption is that when we say 'extension' we mean an extended class vs. an extended profile. Given we have Patching Extensions now, it is possible to creating an extended profile without introducing a new class. If that is what you mean, some of that is covered in the Patching Extensions article.