ocsf

Open-Source Network Management, Monitoring, ITOM, and Security Analytics

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

collector

OXA - Open XDR architecture

OCSF-Tool: A command-line utility for managing Open Cybersecurity Schema Framework (OCSF) schemas, Supporting Proto file generation for OCSF Schemas.

Open-source SIEM pipeline: raw security logs → OCSF → correlation rules → alerts. OT and IT in one pipeline. Local-first AI triage, 10-minute self-hosted quickstart.

Go implementation of Open Cybersecurity Schema Framework (OCSF) for standardized cybersecurity data handling, ensuring easy integration and high performance in Go applications.

Honeypot as code. Engage the adversary. Cultivate the data.

Schema mappings in SQL and PySpark for ELT pipelines to normalize data to OCSF

OCSF schema for Rust

Console-IR. OCSF-native incident response and investigation TUI for the terminal. Triage findings, pivot on indicators, investigate hosts and accounts, GeoIP and WHOIS enrichment, case management, write the report. Single Go binary, SQLite, no server. Open Cybersecurity Schema Framework security tooling for SOC analysts and DFIR.

Extracts and structures Fortigate Log Reference documentation into machine-readable CSV schemas, and translates them into ECS and OCSF field mappings. Built for security engineers and data teams building parsers, normalization pipelines, or field references.

Implementation of OCSF Schemas in Golang

131 deterministic cloud & AI security skills — OCSF 1.8, MCP tools, HITL-gated remediation. AWS · GCP · Azure · K8s · SaaS.

Verifiable identity and tamper-evident OCSF audit records for AI agents — signed event chains, offline verification, agent mandates.

Pure-Rust passive deep packet inspection for OT/ICS and IT — Modbus, DNP3, S7comm, OPC UA, IEC 61850, SMB2, Kerberos, LDAP. PCAP/PCAPNG → Bronze v2 / OCSF / InfluxDB. Zero C deps.

Extracts and structures PAN-OS syslog field documentation into machine-readable CSV schemas, and translates them into ECS and OCSF field mappings. Built for security engineers and data teams building parsers, normalization pipelines, or field references.

Security analytics data lake for GRC & Trust: governance datasets, findings pipelines, compliance analytics, audit trails, and control-plane reporting.

Normalise security alerts from six SIEM/vendor formats into one OCSF (1.8.0) Detection Finding schema. Synthetic data; production-quality reference for OCSF normalisation.

Process AWS Security Hub v2 (OCSF) findings with auto-suppression rules, filtering, and optional Slack alerts