The Open Cybersecurity Schema Framework is an open-source project, delivering an extensible framework for developing schemas, along with a vendor-agnostic core security schema. Vendors and other data producers can adopt and extend the schema for their specific domains. Data engineers can map differing schemas to help security teams simplify data ingestion and normalization, so that data scientists and analysts can work with a common language for threat detection and investigation. The goal is to provide an open standard, adopted in any environment, application, or solution, while complementing existing security standards and processes.
The framework is made up of a set of data types, an attribute dictionary, and the taxonomy. It is not restricted to the cybersecurity domain nor to events, however the initial focus of the framework has been a schema for cybersecurity events. OCSF is agnostic to storage format, data collection and ETL processes. The core schema for cybersecurity events is intended to be agnostic to implementations. The schema framework definition files and the resulting normative schema are written as JSON.
Refer to the white paper Understanding the Open Cybersecurity Schema Framework for an introduction to the framework and schema. A schema browser for the cybersecurity schema can be found at OCSF Schema, where the user can easily navigate the schema, apply profiles and extensions, and browse the attributes, objects and event classes.
November 19, 2024 is a milestone in the continued progress of the OCSF consortium of companies and individuals committed to the standardization of cybersecurity related events. We are pleased that an organization as storied and consequential as the Linux Foundation has considered our progress to be worthy of becoming a Linux Foundation Project. OCSF development will not change as the Linux Foundation policies and governance model is consistent with the current model. Please review the Technical Charter.
We are maintaining a list of FAQs here.
OCSF has a Steering Committee and Maintainers in addition to Contributors. Interested in contributing to the OCSF project? Please check out the documentation on how in the OCSF Contribution Guide file.
List of Contributing Organizations
The project has a Slack workspace where contributors discuss issues and topics. If you would like to be invited to join, create a new discussion with your request on the OCSF Discussions page — please use the "Slack Workspace Requests" category. Tell us about interests and introduce yourself to the group after you accept an invite.
OCSF is licensed under the Apache License 2.0. Check out the LICENSE file to understand the requirements to use the artifacts of the project.
Copyright © OCSF a Series of LF Projects, LLC
For web site terms of use, trademark policy and other project policies please see LF Projects, LLC.
