The Open Cybersecurity Schema Framework defines a comprehensive taxonomy for security event data.
Current Version: 1.1.0
OCSF events are organized into logical categories:
| Category ID | Category Name | Description |
|---|---|---|
| 1 | System Activity | Operating system and device events |
| 2 | Findings | Security detections and vulnerabilities |
| 3 | Identity & Access Management | Authentication and authorization |
| 4 | Network Activity | Network connections and traffic |
| 5 | Discovery | Asset and service discovery |
| 6 | Application Activity | Application-level events |
Each category contains multiple event classes. Examples:
Reusable objects used across multiple event classes:
{
"name": "john.doe",
"uid": "1001",
"email": "john.doe@example.com",
"domain": "CORPORATE",
"type": "User",
"type_id": 1
}
{
"name": "LAPTOP-ABC123",
"hostname": "laptop-abc123.corp.local",
"ip": "192.168.1.100",
"mac": "00:11:22:33:44:55",
"os": {
"name": "Windows 11",
"type": "Windows",
"version": "22H2"
}
}
{
"name": "chrome.exe",
"pid": 5432,
"file": {
"name": "chrome.exe",
"path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
},
"cmd_line": "\"chrome.exe\" --new-window",
"user": {
"name": "john.doe"
}
}
class_uid - Event class unique identifierclass_name - Event class namecategory_uid - Category identifiercategory_name - Category nameseverity_id - Severity identifiertime - Event timestamp (Unix epoch milliseconds)metadata - Event metadata objectmessage - Human-readable event descriptionstatus - Event status/outcomeactivity_id - Specific activity identifiertype_uid - Event type identifierVary by event class - see specific class documentation.
| Severity ID | Severity | Description |
|---|---|---|
| 0 | Unknown | Severity not specified |
| 1 | Informational | Informational event |
| 2 | Low | Low impact |
| 3 | Medium | Medium impact |
| 4 | High | High impact |
| 5 | Critical | Critical impact |
| 99 | Other | Other severity level |
| Status ID | Status | Description |
|---|---|---|
| 0 | Unknown | Status unknown |
| 1 | Success | Operation successful |
| 2 | Failure | Operation failed |
| 99 | Other | Other status |
OCSF supports extensions for vendor-specific or custom fields:
{
"class_uid": 3002,
"unmapped": {
"vendor_field_1": "custom_value",
"vendor_field_2": 12345
}
}
Access the latest schema files via our File Browser.
For the most up-to-date schema information, visit schema.ocsf.io