OCSF Schema Overview

Anomali Search supports Version 1.2 of the Open Cybersecurity Schema Framework (OCSF) schema, an industry-standard schema for normalizing security event data. OCSF provides a consistent structure for security telemetry across diverse log sources, enabling interoperability with OCSF-native tools and standardized threat detection workflows.

Note: For OCSF schema fields, array indexes start at array[1] and not array[0].

OCSF and eventlog: Dual-Schema Architecture

Anomali Search uses a dual-feed architecture where both eventlog and ocsf tables coexist. Users select which schema to query by specifying a table prefix in their search queries.

Schema Default Table? Description Usage
eventlog Yes

  • Stores event telemetry your organization ingests into Security Analytics. Event fields are normalized to the event log schema, and Search automatically extracts additional fields from raw messages such as JSON.

  • When you search the event log, specify field names from the event log schema, such as src, dst, protocol. See eventlog for more information.

  • eventlog is the implicit search table if you do not specify anything. Alternatively, you can optionally specify the table name eventlog before the first pipe.

  • The time picker uses event time, which corresponds to the timestamp stored in the event log.
 eventlog | where src = "10.0.0.1"
or omit prefix for default:
| where src = "10.0.0.1"
OCSF No

  • Stores event telemetry normalized to the OCSF Version 1.2 schema.

  • OCSF fields use nested object notation like src_endpoint.ip, or actor.user.name. See OCSF Schema Overview for more information.

  • To use OCSF fields, specify the case-insensitive keyword "ocsf" before the first pipe. For example:

    Copy 
    ocsf | where src_endpoint.ip = "10.0.0.1"
 ocsf | where src_endpoint.ip = "10.0.0.1"

For the complete eventlog schema reference, see eventlog . For the official OCSF specification, see the official OCSF documentation.

Supported OCSF Categories

Anomali Search supports the following OCSF Version 1.2 categories:

OCSF Category Description
System Activity Events related to operating system activities, including process creation, file system operations, kernel events, and system service activities.
Findings Security findings, alerts, and detections from security tools such as EDR, SIEM, vulnerability scanners, and threat intelligence platforms.
Identity and Access Management Authentication events, authorization activities, user account management, privilege escalation, and identity-related security events.
Network Activity Network traffic events including connections, flows, HTTP requests, DNS queries, firewall logs, and network protocol activities.
Discovery Reconnaissance and discovery activities, including device enumeration, service discovery, network scanning, and information gathering events.
Application Activity Application-level events such as web application logs, API calls, cloud service activities, and software-specific security events.

To query events from a specific OCSF category, use the category_name field. For example:

Copy 
ocsf | where category_name = "Network Activity"

Supported OCSF Classes for Anomali Copilot

Anomali Copilot supports the following OCSF classes:

OCSF Category Description
API Activity API call events capturing request and response details, including REST endpoints, methods, status codes, and resource identifiers for cloud and application service interactions.
Account Change User account lifecycle events including account creation, deletion, enabling, disabling, password changes, and attribute modifications.
Authentication Authentication and session events including login attempts, logon successes and failures, multi-factor authentication, and single sign-on activities.
Email Activity Email handling events covering message sending, receiving, delivery, forwarding, and filtering activities, including attachment and email metadata.
Entity Management Lifecycle events for managed entities such as configurations, policies, certificates, and organizational objects, including creation, modification, and deletion.
Filesystem Activity File system operation events including file creation, deletion, modification, access, and attribute changes across local and network storage.
Group Management Group lifecycle events covering group creation, deletion, and modification, including membership additions and removals.
HTTP Activity Web traffic events capturing HTTP and HTTPS request and response details, including URLs, methods, status codes, user agents, and payload metadata.
Network Activity Network connection and traffic events including TCP/UDP sessions, flows, firewall logs, and network protocol activities between endpoints.
Process Activity Process lifecycle events including process launch, termination, injection, and other activities that describe process execution and behavior on a host.

Using OCSF in Search

To query OCSF data, prefix your search query with ocsf followed by a pipe (|) and your AQL operators.

Note: For OCSF schema fields, array indexes start at array[1] and not array[0].

Basic OCSF Query Syntax

Copy 
ocsf | where <field> = <value>

OCSF Field Notation

OCSF uses dotted notation to access nested object fields. Use the dot (.) operator to traverse through nested structures.

The following table presents a few examples of how eventlog fields map to their equivalent OCSF fields:

eventlog Field OCSF Equivalent
src src_endpoint.ip
dst dst_endpoint.ip
src_port src_endpoint.port
dest_port dst_endpoint.port
user actor.user.name
protocol connection_info.protocol_name

For the complete list of the OCSF Schema fields, see OCSF Schema.

Field Naming Conventions

Note: For OCSF schema fields, array indexes start at array[1] and not array[0].

OCSF organizes fields into nested objects representing entities and attributes. Common OCSF object patterns include:

  • Endpoints: src_endpoint, dst_endpoint contain IP addresses, ports, hostnames, and network identifiers
  • Actor: actor.user, actor.process describe who or what initiated an activity
  • Metadata: metadata contains event timestamps, log sources, and event identifiers
  • Connection Info: connection_info holds network protocol details
  • File: file.name, file.path, file.hash describe file attributes

For the complete list of the OCSF Schema fields, see OCSF Schema.

Example: Complex Nested Structure

The following query demonstrates accessing deeply nested OCSF fields:

Copy 
ocsf | where actor.process.file.name = "powershell.exe" and actor.user.uid = "S-1-5-21-12345"

OCSF for Role-Based Access Control

OCSF schema supports Role-Based Access Control, allowing organization administrators to define OCSF filters in user roles to restrict access to specific OCSF categories. See Role-Based Access Control for Schemas for more information.

Examples

Note: For OCSF schema fields, array indexes start at array[1] and not array[0].

Example 1: Network Activity Query

Query network connections from a specific source IP address.

eventlog Query OCSF Query
Copy 
eventlog | where src = "10.2.3.128" and dest_port = 443
Copy 
ocsf | where category_name = "Network Activity" and 
src_endpoint.ip = "10.2.3.128" and dst_endpoint.port = 443

Example 2: Identity and Access Management

Find authentication attempts for a specific user.

eventlog Query OCSF Query
Copy 
eventlog | where action = "remote user logout" and user = "john.doe"
Copy 
ocsf | where category_name = "Identity & Access Management"
| where class_name = "Authentication"
| where activity_name = "Logon" and user.name = "john.doe"

Example 3: System Activity - Process Events

Show process activity events where the initiating (actor) process is a regular file.

Copy 
ocsf | where category_name = "System Activity" and activity_name = "Process Launch" and actor.process.cmd_line contains "powershell" and actor.process.cmd_line contains "-enc"

Example 4: Aggregation by Source Endpoint

Count network connections by source IP address.

eventlog Query OCSF Query
Copy 
eventlog | aggr count by src
Copy 
ocsf | aggr count by src_endpoint.ip

Example 5: Findings - High Warning Network Activity

Filter network activity events flagged with a warning-level severity where the outcome or status detail is unknown.

Copy 
ocsf | where category_name = "Network Activity" and severity = "warning" and status_detail = "Unknown"

Example 6: Extracts named and positional groups from a structured string using regex, then returns only the job capture group.

Copy 
ocsf 
| limit 1 
| calc test='Name: Alice, Age: 30, Job: Engineer' 
| rex field=test 'Name: (\w+), Age: (\d+), Job: (?P<job>\w+)' 
| fields job

Example 7: Retrieves all malicious IP IOC matches, then appends exploit IP IOC matches to produce a combined threat indicator result set for hunting across both IOC types

Copy 
iocmatch_ocsf | where itype = 'mal_ip' | appendtable [iocmatch_ocsf | where itype = 'exploit_ip']