OCSF Correlation Tables

The Anomali Security Analytics correlation engine generates OCSF-formatted output tables when it processes your event logs against ThreatStream intelligence.

The three following tables span the OCSF schema for correlations and are available for querying with AQL in Anomali Search:

• iocmatch_ocsf: Stores the results of IOC correlations.

• dgamatch_ocsf: Stores the results of domain generated algorithm (DGA) detections.

• tmmatch_ocsf: Store the results of threat model matching.

See OCSF Schema Overview for more information on the OCSF Version 1.2 field names and conventions.