ocsf

Open-Source Network Management, Monitoring, ITOM, and Security Analytics

This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.

collector

OXA - Open XDR architecture

OCSF-Tool: A command-line utility for managing Open Cybersecurity Schema Framework (OCSF) schemas, Supporting Proto file generation for OCSF Schemas.

Go implementation of Open Cybersecurity Schema Framework (OCSF) for standardized cybersecurity data handling, ensuring easy integration and high performance in Go applications.

Open-source SIEM pipeline: raw security logs → OCSF → correlation rules → alerts. OT and IT in one pipeline. Local-first AI triage, 10-minute self-hosted quickstart.

Honeypot as code. Engage the adversary. Cultivate the data.

Schema mappings in SQL and PySpark for ELT pipelines to normalize data to OCSF

OCSF schema for Rust

Console-IR. OCSF-native incident response and investigation TUI for the terminal. Triage findings, pivot on indicators, investigate hosts and accounts, GeoIP and WHOIS enrichment, case management, write the report. Single Go binary, SQLite, no server. Open Cybersecurity Schema Framework security tooling for SOC analysts and DFIR.

Extracts and structures Fortigate Log Reference documentation into machine-readable CSV schemas, and translates them into ECS and OCSF field mappings. Built for security engineers and data teams building parsers, normalization pipelines, or field references.

Implementation of OCSF Schemas in Golang

131 deterministic cloud & AI security skills — OCSF 1.8, MCP tools, HITL-gated remediation. AWS · GCP · Azure · K8s · SaaS.

Verifiable identity and tamper-evident OCSF audit records for AI agents — signed event chains, offline verification, agent mandates.

Pure-Rust passive deep packet inspection for OT/ICS and IT — Modbus, DNP3, S7comm, OPC UA, IEC 61850, SMB2, Kerberos, LDAP. PCAP/PCAPNG → Bronze v2 / OCSF / InfluxDB. Zero C deps.

Security analytics data lake for GRC & Trust: governance datasets, findings pipelines, compliance analytics, audit trails, and control-plane reporting.

Extracts and structures PAN-OS syslog field documentation into machine-readable CSV schemas, and translates them into ECS and OCSF field mappings. Built for security engineers and data teams building parsers, normalization pipelines, or field references.

Normalise security alerts from six SIEM/vendor formats into one OCSF (1.8.0) Detection Finding schema. Synthetic data; production-quality reference for OCSF normalisation.

AI powered security investigation platform that correlates Elastic Security alerts into deterministic attack chains with OCSF normalization, risk scoring, grounded AI analysis, and analyst-focused incident investigations.