OCSF explained: The shared data language security teams have been missing

OCSF is an open-source schema framework that standardizes how security events and context are represented across vendors.

The project was announced by AWS and Splunk in August 2022 and expanded from 17 companies to over 200 organizations by August 2024.

Major vendors and tools like AWS Security Lake, Splunk, Cribl, Palo Alto Networks, and CrowdStrike support converting or ingesting OCSF-formatted data.

Recent OCSF releases added fields to trace AI assistant actions and tool calls, addressing telemetry needs from AI systems.