OCSF

The Open Cybersecurity Schema Framework: an open, vendor-neutral schema for security events and findings, so logs from firewalls, endpoints, identity providers and clouds arrive with the same field names and can be queried and correlated together.

Linux Foundation project

What it is: Threat detection (SIEM)
Type: Open source
Made by: OCSF project (Linux Foundation), started by AWS and Splunk
Foundation: The Linux Foundation, joined November 2024. A series of LF Projects, LLC, since November 2024
License: Apache 2.0
Facts checked: 28 October 2026

What it is

Every security product logs in its own format, so a SIEM or data lake spends much of its effort mapping fields such as “source IP” or “user name” before any rule can run across sources. OCSF defines one schema for that data. It starts from a dictionary of named, typed attributes and builds objects from them, such as process, user, device and file. Each event belongs to one event class, such as Process Activity, Authentication, DNS Activity or Detection Finding, and each class sits in one of eight categories: System Activity, Findings, Identity & Access Management, Network Activity, Discovery, Application Activity, Remediation and Unmanned Systems. Numbers identify everything: Process Activity is class_uid 1007 in category 1, its Launch activity is activity_id 1, and type_uid is class_uid × 100 + activity_id, here 100701.

Profiles overlay extra attributes across classes when the data exists, such as Host, Cloud, Container, Security Control or, since version 1.8, AI Operation; extensions let a vendor or platform add classes and attributes without changing the core, as the Linux, macOS and Windows extensions do. Every event carries a required severity_id, an observables array that lifts key values such as IP addresses, hashes or process names into one searchable place, the original record in raw_data if wanted, and fields it could not map in unmapped. OCSF is a specification and a schema, not a product: version 1.9.0 came out on August 3, 2026, the schema is published under Apache 2.0, and products such as Amazon Security Lake store and exchange data in it.

Why teams pick it

One set of field names across vendors, so a detection rule or query written once works on data from many sources
Backed by both sides of the market: started by AWS and Splunk, with security vendors, government agencies and universities among about 200 participating organisations
Extensible without forking: profiles and registered extensions add attributes and classes while the core stays shared
Used as a storage format, not only an interchange format: Amazon Security Lake converts AWS logs to OCSF and keeps them as Parquet in your own S3 buckets

Watch out for

Mapping is still work: each source needs a translation into OCSF classes, and fields that don’t fit end up in unmapped
The schema changes every few months (1.7 in November 2025, 1.8 in March 2026, 1.9 in August 2026), and producers and consumers may sit on different versions; Security Lake’s current AWS sources write OCSF 1.1.0
It defines data, not detections: rules still come from your SIEM or a format such as Sigma, which uses its own field taxonomy
Its path to an international standard is unfinished: ITU-T member states backed it in December 2025, but objections to the draft Recommendation were still being raised in Study Group 17 in September 2026

Alternatives

What all threat detection (siem) have in common →Compare side by side →

osqueryOpen sourceAn agent for Linux, macOS and Windows that exposes the operating system as SQL tables, so you can query processes, users, open ports, installed software and more, interactively or on a schedule that logs what changed.

RSigmaOpen sourceA Rust toolkit that parses Sigma rules, compiles them into matchers and evaluates them against log events in real time, correlations included, as one self-contained binary.

SigmaOpen sourceAn open YAML format for detection rules over log events, with a community repository of more than 3,000 rules and tools that convert them into each SIEM’s query language.

How it fits with other technologies

What uses OCSF

AGNTCYmodels its agent schema onOCSFAI agents

An abridged OCSF Process Activity event: a shell launching curl · json

{
  "category_uid": 1,
  "category_name": "System Activity",
  "class_uid": 1007,
  "class_name": "Process Activity",
  "activity_id": 1,
  "activity_name": "Launch",
  "type_uid": 100701,
  "type_name": "Process Activity: Launch",
  "time": 1761652800000,
  "severity_id": 1,
  "severity": "Informational",
  "metadata": {
    "version": "1.9.0",
    "product": { "name": "Example EDR", "vendor_name": "Example Corp" }
  },
  "actor": { "process": { "pid": 812, "name": "bash" } },
  "process": {
    "pid": 4242,
    "name": "curl",
    "cmd_line": "curl -s http://203.0.113.7/x.sh",
    "file": { "name": "curl", "path": "/usr/bin/curl", "type_id": 1 }
  },
  "observables": [
    { "name": "process.name", "type_id": 9, "value": "curl" }
  ]
}

The eight categories#

A class’s class_uid is its category number times 1,000 plus its own number, so every Network Activity class starts with 4. The core schema on GitHub has about 80 event classes.

	Examples of event classes
1 System Activity	File System, Process, Module, Kernel and Script Activity; Scheduled Job Activity
2 Findings	Detection, Vulnerability, Compliance, Incident and Data Security Finding
3 Identity & Access Management	Account Change, Authentication, Authorize Session, Group Management, User Access Management
4 Network Activity	Network, HTTP, DNS, SSH, RDP, SMB and Email Activity
5 Discovery	Device, User and Software Inventory Info; Cloud Resources Inventory Info; Process and Service Query
6 Application Activity	API Activity, Web Resources Activity, Datastore Activity, Application Lifecycle
7 Remediation	File, Process and Network Remediation Activity
8 Unmanned Systems	Drone Flights Activity, Airborne Broadcast Activity

See it in a real stack

No architecture uses OCSF yet. Drop it into the playground and wire it up yourself.Open playground →

Where it came from2022–2026

Security teams spent much of their time normalising data: every firewall, endpoint agent and cloud service described the same activity with different field names, so correlating events meant writing and maintaining mappings for each. At Black Hat USA in August 2022, AWS and Splunk announced OCSF to fix that, building on the ICD Schema that Symantec, a division of Broadcom, had developed, with 15 more initial members including Cloudflare, CrowdStrike, IBM Security, Okta, Palo Alto Networks, Rapid7, Salesforce, Trend Micro and Zscaler.

Version 1.0.0 came out in 2023, and on November 19, 2024 OCSF joined the Linux Foundation, announced at its Member Summit; it then had more than 900 contributors from about 200 organisations, and the move put the schema under a neutral body rather than the companies that started it. Minor versions have kept coming every few months: 1.3.0 in August 2024 added classes for software inventory and remediation and an OSINT profile, and 1.8.0 in March 2026 added support for AI operations.

OCSF has also gone to the International Telecommunication Union as draft Recommendation ITU-T X.icd-schemas. According to AWS, ITU member states supported it for ratification in December 2025; Study Group 17 was still discussing objections to the draft in September 2026.

Why it’s built this way

Start from an existing schema: AWS and Splunk built on the ICD Schema work done at Symantec, so the project began from an existing security event schema rather than a blank page.
Numeric IDs alongside names: The schema prefers enumerated integers to strings for consistency, so classes, activities and severities are numbers such as class_uid and severity_id, each with a sibling string for people to read.
Profiles and extensions instead of a monolith: Cloud, container and host details apply across many classes, and vendors need their own fields, so both are layered on without changing the core schema.

Timeline

2022
AWS and Splunk announce OCSF at Black Hat USA in August, with 18 initial organisations
2023
Version 1.0.0 released
2024
OCSF joins the Linux Foundation on November 19
2025
ITU-T member states back OCSF for ratification as an international standard (December)
2026
Version 1.8.0 adds an AI Operation profile in March; 1.9.0 released on August 3

Sources9 · facts checked 28 October 2026

Improve this page on GitHub