Open Cybersecurity Schema Framework (OCSF) Schema

OCSF is designed to be used across the entire security data lifecycle by:

• Log Producers: Applications, devices, and systems generating security events.
• Security Tools: SIEM, SOAR, EDR, and other security platforms.
• Analytics Platforms: Tools processing and analyzing security data.
• Data Pipelines: ETL processes normalizing security data.

The Open Cybersecurity Schema Framework (OCSF) is an open standard for cybersecurity event logging and data normalization. It provides a standardized, extensible, and format-agnostic (JSON, Parquet, Avro, etc.) way to represent security events.

The framework is composed of four primary building blocks:

• Categories: High-level groupings such as Network, System, or Application.
• Event Classes: Specific event types located within a category.
• Objects: Reusable data structures used across different events.
• Attributes: Individual data fields with standardized definitions.

Once a UID and Name are reserved, create a new subdirectory within the extensions/ directory. Inside this subdirectory, you must create an extension.json file to define the extension's metadata.

Example extension.json:

{
  "caption": "New Extension",
  "name": "new_ex",
  "uid": 123,
  "version": "0.0.0"
}

To make your extension public and prevent ID collisions with the core schema or other extensions, you must reserve a unique identifier and name in the OCSF Extensions Registry. This is done by adding a row to the registry table in extensions.md within the repository.

Example registry entry format:

The repository is organized into the following directory structure:

• events/: Event class definitions organized by category.
• objects/: Reusable object definitions.
• profiles/: Schema profiles for specific use cases.
• extensions/: Schema extensions (e.g., Linux, Windows).
• metaschema/: Schema validation rules.
• templates/: Template definitions.
• categories.json: Event category definitions.
• dictionary.json: Attribute dictionary.
• version.json: Current schema version.

An extension's directory structure mirrors the top-level schema directory. Depending on what you are extending, you can include the following files and subdirectories: