OCSF
Look up OCSF reference documentation and answer from those sources. Only state
facts from files you read. Never invent schema details. If the documentation
does not cover the question, say so.
Versions
Use the latest stable version unless the user requests a specific one. Stick to
one version per answer.
- 1.0.0
- 1.1.0
- 1.2.0
- 1.3.0
- 1.4.0
- 1.5.0
- 1.6.0
- 1.7.0
- 1.8.0
- 1.9.0 ← latest stable
- 1.10.0-dev ← unreleased development snapshot
Each version page links to its classes, objects, profiles, extensions, and
types.
File layout
introduction.md # OCSF overview and conceptual sections
introduction/{section}.md
faqs.md # Schema design rationale
faqs/{slug}.md
articles.md # Deep-dive guides on specific topics
articles/{slug}.md
{version}.md # Version summary (what's new, counts)
{version}/classes.md # Class index grouped by category
{version}/classes/{name}.md
{version}/objects.md
{version}/objects/{name}.md
{version}/profiles.md
{version}/profiles/{name}.md
{version}/extensions.md
{version}/extensions/{name}/index.md
{version}/extensions/{name}/events/{event}.md
{version}/extensions/{name}/objects/{object}.md
{version}/extensions/{name}/profiles/{profile}.md
{version}/types.md
Question routing
Pick the shortest reading path for the question type.
| Question pattern |
Start here |
| Which class fits event X? |
Category table below → version classes index → candidate class pages |
| What attributes does class/object Y have? |
Version classes or objects index → the specific page |
| How do profiles work? / Which profile for X? |
Introduction: Profiles → version profiles index |
| How do I extend the schema? |
Introduction: Extensions or Patching the Core Schema |
| How do I populate observables / model alerts? |
FAQs and Articles |
| What changed between versions? |
Compare the two version pages |
| Conceptual / design question |
Introduction → FAQs |
When the question asks you to pick a class, read multiple candidates and explain
trade-offs.
Domain knowledge
Core concepts
Attributes are named fields with a data type. Every OCSF field has a
requirement level: required, recommended, or optional.
Objects group related attributes into reusable structures. Objects can nest
other objects.
Event classes define schemas for specific security events. Each class belongs
to a category and inherits from Base Event.
Base Event provides universal attributes and serves as a catch-all when no
more specific class fits.
Profiles are mix-ins that add cross-cutting attributes. A class can apply
multiple profiles.
Extensions add vendor-specific attributes without modifying the core schema.
Event categories
Use the category range to narrow scope before diving into individual class
pages.
| Range |
Category |
Focus |
| 1xxx |
System Activity |
OS-level: process, file, module, memory, kernel, registry |
| 2xxx |
Findings |
Detections, vulnerabilities, incidents, compliance |
| 3xxx |
IAM |
Authentication, authorization, account and group changes |
| 4xxx |
Network Activity |
General traffic and protocol-specific activity |
| 5xxx |
Discovery |
Device, user, service, and resource enumeration |
| 6xxx |
Application Activity |
Web resources, API calls, file hosting, datastore operations |
| 7xxx |
Remediation |
File, process, network, and entity remediation actions |
| 8xxx |
Unmanned |
Drones, vehicles, and robots |
Naming conventions
snake_case everywhere: process_activity, network_endpoint.- Arrays use plural names:
answers, enrichments, attacks.
- When
_id is Other (99), the sibling string must be populated with
the source value.
Key suffixes:
| Suffix |
Meaning |
_id |
Enum integer identifier with a sibling string (same name minus _id). 0 = Unknown, 99 = Other. |
_uid |
Schema-unique or external unique identifier (integer for classification attrs, string otherwise). Sibling uses _name. |
_uuid |
Globally unique 128-bit identifier (string). No sibling. |
_name |
Friendly name / caption sibling for _uid or _id attributes. |
_time |
Timestamp (timestamp_t, milliseconds since epoch). |
_dt |
Datetime (datetime_t, RFC 3339 string). Added by the Date/Time profile alongside _time attributes. |
_info / _detail |
Object carrying supplementary information. |
_process |
Reference to a Process object. |
_ver |
Version string. |
_list |
Array of values. |
Answering principles
- Read before answering. Every claim must trace back to a file you read.
- Use the question routing table and category table to narrow scope before
reading class or object pages.
- Consult FAQs for schema design rationale and ambiguous mappings.
- Consult Articles for deep-dive topics like observables, alerts,
process parentage, and extensions.
- Read Introduction sections for conceptual questions about
the framework itself.
1---2name: tenzir-ocsf3description: Answer questions about OCSF (Open Cybersecurity Schema Framework). Use when the user asks about OCSF classes, objects, attributes, profiles, extensions, or event normalization.4---56# OCSF78Look up OCSF reference documentation and answer from those sources. Only state9facts from files you read. Never invent schema details. If the documentation10does not cover the question, say so.1112## Versions1314Use the latest stable version unless the user requests a specific one. Stick to15one version per answer.1617- [1.0.0](v1.0.0.md)18- [1.1.0](v1.1.0.md)19- [1.2.0](v1.2.0.md)20- [1.3.0](v1.3.0.md)21- [1.4.0](v1.4.0.md)22- [1.5.0](v1.5.0.md)23- [1.6.0](v1.6.0.md)24- [1.7.0](v1.7.0.md)25- [1.8.0](v1.8.0.md)26- **[1.9.0](v1.9.0.md)** ← latest stable27- [1.10.0-dev](v1.10.0-dev.md) ← unreleased development snapshot2829Each version page links to its classes, objects, profiles, extensions, and30types.3132## File layout3334```35introduction.md # OCSF overview and conceptual sections36introduction/{section}.md37faqs.md # Schema design rationale38faqs/{slug}.md39articles.md # Deep-dive guides on specific topics40articles/{slug}.md41{version}.md # Version summary (what's new, counts)42{version}/classes.md # Class index grouped by category43{version}/classes/{name}.md44{version}/objects.md45{version}/objects/{name}.md46{version}/profiles.md47{version}/profiles/{name}.md48{version}/extensions.md49{version}/extensions/{name}/index.md50{version}/extensions/{name}/events/{event}.md51{version}/extensions/{name}/objects/{object}.md52{version}/extensions/{name}/profiles/{profile}.md53{version}/types.md54```5556## Question routing5758Pick the shortest reading path for the question type.5960| Question pattern | Start here |61| --- | --- |62| Which class fits event X? | Category table below → version classes index → candidate class pages |63| What attributes does class/object Y have? | Version classes or objects index → the specific page |64| How do profiles work? / Which profile for X? | [Introduction: Profiles](introduction/profiles.md) → version profiles index |65| How do I extend the schema? | [Introduction: Extensions](introduction/extensions.md) or [Patching the Core Schema](articles/patching-core-using-extensions.md) |66| How do I populate observables / model alerts? | [FAQs](faqs.md) and [Articles](articles.md) |67| What changed between versions? | Compare the two version pages |68| Conceptual / design question | [Introduction](introduction.md) → [FAQs](faqs.md) |6970When the question asks you to pick a class, read multiple candidates and explain71trade-offs.7273## Domain knowledge7475### Core concepts7677**Attributes** are named fields with a data type. Every OCSF field has a78requirement level: required, recommended, or optional.7980**Objects** group related attributes into reusable structures. Objects can nest81other objects.8283**Event classes** define schemas for specific security events. Each class belongs84to a category and inherits from Base Event.8586**Base Event** provides universal attributes and serves as a catch-all when no87more specific class fits.8889**Profiles** are mix-ins that add cross-cutting attributes. A class can apply90multiple profiles.9192**Extensions** add vendor-specific attributes without modifying the core schema.9394### Event categories9596Use the category range to narrow scope before diving into individual class97pages.9899| Range | Category | Focus |100| ----- | -------- | ----- |101| 1xxx | System Activity | OS-level: process, file, module, memory, kernel, registry |102| 2xxx | Findings | Detections, vulnerabilities, incidents, compliance |103| 3xxx | IAM | Authentication, authorization, account and group changes |104| 4xxx | Network Activity | General traffic and protocol-specific activity |105| 5xxx | Discovery | Device, user, service, and resource enumeration |106| 6xxx | Application Activity | Web resources, API calls, file hosting, datastore operations |107| 7xxx | Remediation | File, process, network, and entity remediation actions |108| 8xxx | Unmanned | Drones, vehicles, and robots |109110### Naming conventions111112- `snake_case` everywhere: `process_activity`, `network_endpoint`.113- Arrays use plural names: `answers`, `enrichments`, `attacks`.114- When `_id` is `Other` (`99`), the sibling string **must** be populated with115 the source value.116117Key suffixes:118119| Suffix | Meaning |120| ------ | ------- |121| `_id` | Enum integer identifier with a sibling string (same name minus `_id`). `0` = Unknown, `99` = Other. |122| `_uid` | Schema-unique or external unique identifier (integer for classification attrs, string otherwise). Sibling uses `_name`. |123| `_uuid` | Globally unique 128-bit identifier (string). No sibling. |124| `_name` | Friendly name / caption sibling for `_uid` or `_id` attributes. |125| `_time` | Timestamp (`timestamp_t`, milliseconds since epoch). |126| `_dt` | Datetime (`datetime_t`, RFC 3339 string). Added by the Date/Time profile alongside `_time` attributes. |127| `_info` / `_detail` | Object carrying supplementary information. |128| `_process` | Reference to a Process object. |129| `_ver` | Version string. |130| `_list` | Array of values. |131132## Answering principles133134- Read before answering. Every claim must trace back to a file you read.135- Use the question routing table and category table to narrow scope before136 reading class or object pages.137- Consult [FAQs](faqs.md) for schema design rationale and ambiguous mappings.138- Consult [Articles](articles.md) for deep-dive topics like observables, alerts,139 process parentage, and extensions.140- Read [Introduction](introduction.md) sections for conceptual questions about141 the framework itself.
tenzir