Profiles in OCSF are a way to uniformly add a set of attributes to one or more event classes or objects. Event classes provide the basic structure and type of an event, while objects provide the structure of complex types. Their definitions can indicate that additional attributes may be included with an event instance via profiles specified with the class or object definition. In effect, adding a profile or profiles to the definition gives you the permission to dynamically include those attributes. When constructing an event, you would add an OCSF profile name to the metadata.profiles array to mix-in the additional attributes with the event.
An event that has that profile applied is then a kind of that profile, as well as a kind of the event class. For example, if the Host profile was applied to the HTTP Activity class to add the actor.process making a request, the event would be queryable either via the metadata.profiles[] as Host or via class_name as HTTP Activity. If using Host other events from System Activity could also be returned with the same actor.
Not all of the attributes from the profile need be added together. For example, a profile with attributes A, B, C can be defined within the definition of class D and object E. Class D can include A and B, while object E can include attribute C. You can also build in a profile, by adding the attributes of the profile directly into your class, and referencing the profile in your class definition. In this case, as with class and object extensions, the profile defined requirements, group or description can be overridden within the definition of the class or object, although this is not recommended. Only the attribute data type and constraints cannot be overridden.