Skip to main content
Version: 1.5.0

OCSF

The Open Cybersecurity Schema Framework (OCSF) is an open standard for security event data that provides a vendor-agnostic way to normalize security logs across different sources. OCSF provides standardization for security-focused log data, enabling seamless integration with AWS Security Lake and other security analytics platforms.

OCSF organizes security events into classes, each representing a specific type of security activity. When using field_format: "ocsf", VirtualMetric automatically transforms your security data into OCSF-compliant format based on the event type.

Available OCSF Schema Classes​

System Activity (1000-1999)​

  • OCSF1001 - File Activity
  • OCSF1002 - Kernel Extension Activity
  • OCSF1003 - Kernel Activity
  • OCSF1004 - Memory Activity
  • OCSF1005 - Module Activity
  • OCSF1006 - Scheduled Job Activity
  • OCSF1007 - Process Activity

Findings (2000-2999)​

  • OCSF2001 - Security Finding
  • OCSF2002 - Vulnerability Finding
  • OCSF2003 - Compliance Finding
  • OCSF2004 - Detection Finding

Identity & Access Management (3000-3999)​

  • OCSF3001 - Account Change
  • OCSF3002 - Authentication
  • OCSF3003 - Authorize Session
  • OCSF3004 - Entity Management
  • OCSF3005 - User Access Management
  • OCSF3006 - Group Management

Network Activity (4000-4999)​

  • OCSF4001 - Network Activity
  • OCSF4002 - HTTP Activity
  • OCSF4003 - DNS Activity
  • OCSF4004 - DHCP Activity
  • OCSF4005 - RDP Activity
  • OCSF4006 - SMB Activity
  • OCSF4007 - SSH Activity
  • OCSF4008 - FTP Activity
  • OCSF4009 - Email Activity
  • OCSF4010 - Network File Activity
  • OCSF4011 - Email File Activity
  • OCSF4012 - Email URL Activity
  • OCSF4013 - NTP Activity
  • OCSF4014 - Tunnel Activity

Discovery (5000-5999)​

  • OCSF5001 - Device Inventory Info
  • OCSF5002 - Device Config State
  • OCSF5003 - User Inventory Info
  • OCSF5004 - Operating System Patch State

Application Activity (6000-6999)​

  • OCSF6001 - Web Resources Activity
  • OCSF6002 - Application Lifecycle
  • OCSF6003 - API Activity
  • OCSF6004 - Web Resource Access Activity
  • OCSF6005 - Datastore Activity
  • OCSF6006 - File Hosting Activity

Usage​

To enable OCSF normalization, specify the field format in your target configuration:

targets:
  - name: my_target
    type: awssecuritylake
    properties:
      field_format: "ocsf"

When using the VirtualMetric AWS Security Lake Pack, OCSF normalization is handled automatically through the aws_lake pipeline. The pack intelligently routes events to the appropriate OCSF schema class based on the source data type and vendor.

Integration with AWS Security Lake​

OCSF is the native schema format for AWS Security Lake. When sending data to AWS Security Lake, you must:

  1. Enable OCSF field formatting (handled automatically by the aws_lake pipeline)
  2. Specify the appropriate OCSF schema identifier for each bucket
  3. Ensure data is in Parquet format (handled automatically by the awssecuritylake target)

VirtualMetric AWS Security Lake Pack​

The VirtualMetric AWS Security Lake Pack provides comprehensive OCSF normalization for diverse security data sources:

  • Syslog messages (native, CEF, LEEF formats) are automatically converted to OCSF
  • Windows Security Events are transformed from ECS through ASIM to OCSF
  • Firewall logs from major vendors (Fortinet, Palo Alto Networks, Check Point, Cisco ASA, SonicWall, WatchGuard, Cisco Meraki) are normalized to OCSF
  • Windows DNS logs are converted to OCSF DNS Activity format

The pack handles multi-stage transformations, preserving vendor-specific context while ensuring OCSF compliance for AWS Security Lake ingestion.

Example Configuration​

targets:
  - name: security_lake
    type: awssecuritylake
    pipelines:
      - aws_lake
    properties:
      key: "AKIAIOSFODNN7EXAMPLE"
      secret: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
      region: "us-east-1"
      source: "virtualmetric"
      account: "123456789012"
      buckets:
        - bucket: "aws-security-data-lake-network"
          name: "network-{{.Timestamp}}.parquet"
          schema: "OCSF4001"
        - bucket: "aws-security-data-lake-auth"
          name: "auth-{{.Timestamp}}.parquet"
          schema: "OCSF3002"
        - bucket: "aws-security-data-lake-dns"
          name: "dns-{{.Timestamp}}.parquet"
          schema: "OCSF4003"

In this example, the aws_lake pipeline automatically normalizes all events to OCSF format, and the target routes them to the appropriate buckets based on their schema class.