OCSF
Most recent version: v0.2.1
Overview
The OCSF Action allows users to build messages in accordance with the Open Cybersecurity Schema Framework.
In order to configure this Action, you must first link it to a Listener. Go to Building a Pipeline to learn how to link.
Ports
These are the input and output ports of this Action:
Configuration
To open the configuration, click the Action in the canvas and select Configuration.
Enter the required parameters:
Fields*
This is where you specify the fields you wish to include in your message, color coded by type.
Fields beginning with _
are internal fields.
OCSF Template*
Choose the blueprint used to create the standardized cybersecurity message within the OCSF model.
Destination Field Name*
Give your message a name to identify it by in the end destination.
Message
The message will be automatically transformed to fit the OCSF template selected above, show in JSON format. Drag and drop more fields from the fields area and rearrange them here.
Click Save to complete.
Example
Let's say you have received drone flight logs in JSON format and wish to transform it to a OCSF-formatted JSON using the Drone Flights Activity [8001] schema.
Raw data
{
"drone_id": "DRONE-XT12",
"operator": "alice.wong",
"flight_id": "FL-20250602-0001",
"start_time": "2025-06-02T08:00:00Z",
"end_time": "2025-06-02T08:30:00Z",
"status": "completed",
"latitude": 40.7128,
"longitude": -74.0060,
"altitude_m": 150.0,
"battery_level": 45,
"vendor": "AeroFleet"
}
Build the message
Now use the Message Builder to create a template containing these fields as an OSCF-formatted message.
Select the Drone Flights Activity [8001] schema from the list.
See the JSON reformatted in the Message area:
[
{
"event_class": "drone_activity",
"event_type_id": 8001,
"time": "2025-06-02T08:00:00Z",
"severity_id": 1,
"message": "Drone flight FL-20250602-0001 completed successfully",
"actor": {
"user": {
"name": "alice.wong"
}
},
"drone_activity": {
"drone_id": "DRONE-XT12",
"flight_id": "FL-20250602-0001",
"status": "completed",
"start_time": "2025-06-02T08:00:00Z",
"end_time": "2025-06-02T08:30:00Z",
"location": {
"latitude": 40.7128,
"longitude": -74.0060,
"altitude_m": 150.0
},
"battery_level": 45
},
"metadata": {
"product": {
"name": "DroneLogSystem",
"vendor_name": "AeroFleet"
}
}
}
]
Drag and drop the fields to fill in the template with the real data.
Your message now matches the OCSF best practices: it normalizes data into structured actor
, drone_activity
, and metadata
fields.
Last updated
Was this helpful?