OCSF
The Open Cybersecurity Schema Framework (OCSF) is an open standard for security event data that provides a vendor-agnostic way to normalize security logs across different sources. OCSF provides standardization for security-focused log data, enabling seamless integration with Amazon Security Lake and other security analytics platforms.
OCSF organizes security events into classes, each representing a specific type of security activity. When using field_format: "ocsf", VirtualMetric automatically transforms your security data into OCSF-compliant format based on the event type.
Normalization emits OCSF 1.3.0, written into the metadata.version field of each event.
Available OCSF Schema Classes
System Activity (1000-1999)
OCSF1001- File System ActivityOCSF1002- Kernel Extension ActivityOCSF1003- Kernel ActivityOCSF1004- Memory ActivityOCSF1005- Module ActivityOCSF1006- Scheduled Job ActivityOCSF1007- Process ActivityOCSF1008- Event Log ActivityOCSF1009- Script Activity
Findings (2000-2999)
OCSF2001- Security FindingOCSF2002- Vulnerability FindingOCSF2003- Compliance FindingOCSF2004- Detection FindingOCSF2005- Incident FindingOCSF2006- Data Security Finding (v1.2 - DLP, data classification)OCSF2007- Application Security Posture FindingOCSF2008- IAM Analysis Finding
Identity & Access Management (3000-3999)
OCSF3001- Account ChangeOCSF3002- AuthenticationOCSF3003- Authorize SessionOCSF3004- Entity ManagementOCSF3005- User Access ManagementOCSF3006- Group Management
Network Activity (4000-4999)
OCSF4001- Network ActivityOCSF4002- HTTP ActivityOCSF4003- DNS ActivityOCSF4004- DHCP ActivityOCSF4005- RDP ActivityOCSF4006- SMB ActivityOCSF4007- SSH ActivityOCSF4008- FTP ActivityOCSF4009- Email ActivityOCSF4010- Network File ActivityOCSF4011- Email File ActivityOCSF4012- Email URL ActivityOCSF4013- NTP ActivityOCSF4014- Tunnel Activity
Discovery & Inventory (5000-5999)
OCSF5001- Device Inventory InfoOCSF5002- Device Config StateOCSF5019)OCSF5003- User Inventory InfoOCSF5004- Operating System Patch StateOCSF5006- Kernel Object QueryOCSF5007- File QueryOCSF5008- Folder QueryOCSF5009- Admin Group QueryOCSF5010- Job QueryOCSF5011- Module QueryOCSF5012- Network Connection QueryOCSF5013- Networks QueryOCSF5014- Peripheral Device QueryOCSF5015- Process QueryOCSF5016- Service QueryOCSF5017- User Session QueryOCSF5018- User QueryOCSF5019- Device Config State ChangeOCSF5020- Software Inventory Info (v1.3)OCSF5021- OSINT Inventory Info (v1.3 - threat intelligence)OCSF5022- Startup Item QueryOCSF5023- Cloud Resources Inventory InfoOCSF5040- Live Evidence Info
Application Activity (6000-6999)
OCSF6001- Web Resources ActivityOCSF6002- Application LifecycleOCSF6003- API ActivityOCSF6004- Web Resource Access ActivityOCSF6005- Datastore ActivityOCSF6006- File Hosting ActivityOCSF6007- Scan ActivityOCSF6008- Application Error
Remediation (7000-7999) (v1.3)
OCSF7001- Remediation ActivityOCSF7002- File Remediation ActivityOCSF7003- Process Remediation ActivityOCSF7004- Network Remediation Activity
Unmanned Systems (8000-8999)
OCSF8001- Drone Flights ActivityOCSF8002- Airborne Broadcast Activity
Extension classes
Seven further schemas ship under six-digit identifiers — OCSF201001, OCSF201002, OCSF201003, OCSF201004, OCSF205004, OCSF205005 and OCSF205019. These are OCSF extension classes: the schema files are present and can be referenced, but the normalizer's class-name table does not carry names for them, so they are listed here by identifier only.
Usage
To enable OCSF normalization, specify the field format in your target configuration:
targets:
- name: my_target
type: awssecuritylake
properties:
field_format: "ocsf"
When using the VirtualMetric Amazon Security Lake Pack, OCSF normalization is handled automatically through the aws_lake pipeline. The pack intelligently routes events to the appropriate OCSF schema class based on the source data type and vendor.
Schema Generation
The Director's -mode ocsf generates an OCSF schema document, which is a separate operation from the normalization described above and uses its own version.
vmetric-director -mode ocsf [-schema-name name] [-schema-version version] [-profiles profile1,profile2] [-max-depth depth]
The schema is retrieved from schema.ocsf.io at the version given by -schema-version, so the command requires network access. Omitting the option generates OCSF 1.6.0.
Profile attributes are excluded unless requested with -profiles. The following are available: cloud, container, data_classification, host, incident, load_balancer, network_proxy, osint, security_control, and trace.
Integration with Amazon Security Lake
OCSF is the native schema format for Amazon Security Lake. When sending data to Amazon Security Lake, you must:
- Enable OCSF field formatting (handled automatically by the
aws_lakepipeline) - Specify the appropriate OCSF schema identifier for each bucket
- Ensure data is in Parquet format (handled automatically by the
awssecuritylaketarget)
VirtualMetric Amazon Security Lake Pack
The VirtualMetric Amazon Security Lake Pack provides comprehensive OCSF normalization for diverse security data sources:
- Syslog messages (native, CEF, LEEF formats) are automatically converted to OCSF
- Windows Security Events are transformed from ECS through ASIM to OCSF
- Firewall logs from major vendors (Fortinet, Palo Alto Networks, Check Point, Cisco ASA, SonicWall, WatchGuard, Cisco Meraki) are normalized to OCSF
- Windows DNS logs are converted to OCSF DNS Activity format
The pack handles multi-stage transformations, preserving vendor-specific context while ensuring OCSF compliance for Amazon Security Lake ingestion.
Example Configuration
targets:
- name: security_lake
type: awssecuritylake
pipelines:
- aws_lake
properties:
key: "AKIAIOSFODNN7EXAMPLE"
secret: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
region: "us-east-1"
source: "virtualmetric"
account: "123456789012"
buckets:
- bucket: "aws-security-data-lake-network"
name: "network-{{.Timestamp}}.parquet"
schema: "OCSF4001"
- bucket: "aws-security-data-lake-auth"
name: "auth-{{.Timestamp}}.parquet"
schema: "OCSF3002"
- bucket: "aws-security-data-lake-dns"
name: "dns-{{.Timestamp}}.parquet"
schema: "OCSF4003"
In this example, the aws_lake pipeline automatically normalizes all events to OCSF format, and the target routes them to the appropriate buckets based on their schema class.