ocsf: add OCSF security event analytics demo app

[gangtao]

Summary

Adds a new apps/ocsf/ Timeplus app that streams synthetic OCSF (Open Cybersecurity Schema Framework) security events from the timeplus-ocsf-simulator PyPI package and surfaces real-time threat-detection analytics across five dashboards.

What's in the box

Pipeline (7 resources): a Python streaming external_stream calling ocsf_simulator.stream_ocsf_events → MV → persistent ocsf_events(raw, class_uid) stream with configurable TTL → four flatten views projecting nested JSON into typed columns for each OCSF class:

• v_ocsf_authentication_flatten (3002)
• v_ocsf_network_activity_flatten (4001)
• v_ocsf_process_activity_flatten (1007)
• v_ocsf_security_finding_flatten (2001)

Flatten view bodies copied verbatim from demos/cases/ocsf/extraction.sql with three mechanical edits per file: {{ .DB }} templating, switch WHERE json_value(raw, '$.class_uid') = 'NNNN' → typed class_uid = NNNN, and IF NOT EXISTS.

Five dashboards (each ≤6 live streaming queries):

• OCSF Overview — 4 singleValue counters + About markdown
• OCSF — Authentication — Auth by status/min, Top failed sources, Brute-force candidates
• OCSF — Network Activity — Bytes by protocol/min, High-severity events, Scanning candidates
• OCSF — Process Activity — Process creates/min, Suspicious cmd lines, Privilege-mismatch
• OCSF — Security Findings — Findings by severity/min, Malware by classification, Top finding titles

Config knobs: event_classes, interval_seconds, ocsf_version, retention_hours.

Lessons captured (memory updated)

Two non-obvious dashboard gotchas surfaced during build and are now recorded so future apps avoid them:

• chartType: "singleValue" (camelCase) — single_value is not registered in axion and silently renders "Unable to render chart"
• 12-column position grid, not 24 — putting x=12 or x=18 wraps panels into a stacked column on the right edge

Test plan

• make build install APP=ocsf from a fresh checkout succeeds against a local Timeplus
• Wait ~60s, then SHOW STREAMS FROM ocsf lists ocsf_events_source, ocsf_events, the 4 flatten views, and mv_ocsf_events_ingest
• SELECT class_uid, count() FROM table(ocsf.ocsf_events) GROUP BY class_uid returns positive counts for all of {1007, 2001, 3002, 4001}
• All 5 dashboards open in the UI and every panel renders (no "Unable to render chart", no stuck-loading)
• Multi-series line charts (Auth by status, Bytes by protocol, Findings by severity) show one line per series, not collapsed
• Overview lays out 4 metric panels in a single row above the About markdown
• make build install APP=ocsf over an existing install is a clean upgrade (idempotent CREATEs)

🤖 Generated with Claude Code