thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Open Cybersecurity Schema Framework (OCSF)

An open, vendor-neutral schema for normalizing security event data across tools.

Definition

OCSF, launched in 2022 by AWS, Splunk and others, defines event classes and attributes so logs from different products share consistent fields. Amazon Security Lake stores data in OCSF format. It reduces custom parsing and supports portable analytics.

Example

Amazon Security Lake converting CloudTrail and VPC Flow Logs into OCSF.

Exam tip

OCSF is the open standard; CIM and UDM are vendor-specific data models.

Related terms