Skip to content
@ocsf

Open Cybersecurity Schema Framework

WELCOME TO OCSF

The Open Cybersecurity Schema Framework is an open-source project, delivering an extensible framework for developing schemas, along with a vendor-agnostic core security schema. Vendors and other data producers can adopt and extend the schema for their specific domains. Data engineers can map differing schemas to help security teams simplify data ingestion and normalization, so that data scientists and analysts can work with a common language for threat detection and investigation. The goal is to provide an open standard, adopted in any environment, application, or solution, while complementing existing security standards and processes.

OVERVIEW

The framework is made up of a set of data types, an attribute dictionary, and the taxonomy. It is not restricted to the cybersecurity domain nor to events, however the initial focus of the framework has been a schema for cybersecurity events. OCSF is agnostic to storage format, data collection and ETL processes. The core schema for cybersecurity events is intended to be agnostic to implementations. The schema framework definition files and the resulting normative schema are written as JSON.

Refer to the white paper Understanding the Open Cybersecurity Schema Framework for an introduction to the framework and schema. A schema browser for the cybersecurity schema can be found at OCSF Schema, where the user can easily navigate the schema, apply profiles and extensions, and browse the attributes, objects and event classes.

FAQ

We are maintaining a list of FAQs here

CONTRIBUTORS

OCSF has a Steering Committee and Maintainers in addtion to Contributors. Interested in contributing to the OCSF project? Please check out the documentation on how in the OCSF Contribution Guide file.

List of Contributing Organizations

SLACK WORKSPACE

The project has a Slack workspace where contributors discuss issues and topics. If you would like to be invited to join, send an email to info@ocsf.io. Tell us about interests and introduce yourself to the group after you accept an invite.

LICENSE

OCSF is licensed under the Apache License 2.0. Check out the LICENSE file to understand the requirements to use the artifacts of the project.

Pinned Loading

  1. governance governance Public

    31 8

  2. ocsf-docs ocsf-docs Public

    OCSF Documentation

    107 19

  3. ocsf-schema ocsf-schema Public

    OCSF Schema

    580 118

  4. ocsf-server ocsf-server Public

    OCSF Schema WEB Server

    Elixir 34 25

  5. examples examples Public

    This repo contains example of raw event examples and possible translations to the OCSF schema.

    30 24

Repositories

Showing 10 of 12 repositories
  • ocsf-schema Public

    OCSF Schema

    ocsf/ocsf-schema’s past year of commit activity
    580 Apache-2.0 118 58 12 Updated Jul 3, 2024
  • splunk Public

    The Splunk schema extension repository

    ocsf/splunk’s past year of commit activity
    9 Apache-2.0 3 0 1 Updated Jul 2, 2024
  • ocsf-docs Public

    OCSF Documentation

    ocsf/ocsf-docs’s past year of commit activity
    107 Apache-2.0 19 7 2 Updated Jun 27, 2024
  • ocsf-validate-compatibility Public

    Validate backwards compatibility between two versions of OCSF

    ocsf/ocsf-validate-compatibility’s past year of commit activity
    Python 0 Apache-2.0 0 0 0 Updated Jun 20, 2024
  • ocsf-lib-py Public

    A library of core utilities for working with OCSF in Python

    ocsf/ocsf-lib-py’s past year of commit activity
    Python 0 Apache-2.0 0 0 0 Updated Jun 20, 2024
  • ocsf-server Public

    OCSF Schema WEB Server

    ocsf/ocsf-server’s past year of commit activity
    Elixir 34 Apache-2.0 25 17 0 Updated Jun 18, 2024
  • examples Public

    This repo contains example of raw event examples and possible translations to the OCSF schema.

    ocsf/examples’s past year of commit activity
    30 24 4 7 Updated Jun 14, 2024
  • ocsf-validator Public

    OCSF Schema Validation

    ocsf/ocsf-validator’s past year of commit activity
    Python 8 Apache-2.0 4 2 1 Updated May 30, 2024
  • .github Public

    Entry point for introduction to the schema

    ocsf/.github’s past year of commit activity
    5 Apache-2.0 2 0 0 Updated Apr 27, 2024
  • ocsf/ocsf-java-tools’s past year of commit activity
    Java 2 Apache-2.0 1 0 0 Updated Mar 29, 2024

Most used topics

Loading…