I was wondering how is Cribl implementing OCSF mappings?
Hello all, I was wondering how is Cribl implementing OCSF mappings?
Answers
-
<@U02ELKX57CH> <@U02PA4EAP1S> ^^^
0 -
Hi <@U04S0RP486P>, I can walk you through how we do it. Currently we only support the network activity class, but several more classes are 'work in progress'. If you don't mind me asking, what is your use case for it?
0 -
Hello <@U02ELKX57CH> I was thinking for example use cases to structure like syslog messages better, putting it in OCSF format
0 -
will DM you so we can go into this further
0 -
We have a need for this internally <@U02ELKX57CH> so I'd like to see how we could expand our support. <@U01LSBF5953> does this factor into your Rosetta pack?
0 -
If there's mappings for Windows OS logs for OCSF I can add them to the Rosetta pack
0 -
Not really sure what your intentions were for Rosetta, it's for Windows logs only?
0 -
In general, there's a market need for an any to any mapper. Not sure the product is helping us as much as it could there. It's certainly a set of ideas on the backlog to make mapping schemas easier.
0 -
> it's for Windows logs only Yes
0 -
I mean naming wise, maybe quality it more then :slightly_smiling_face:
0 -
-
Ocsf is massive in structure, we should chat <@U01LSBF5953>
0 -
OCSF, OTel, its like when big vendors get together they just want to make things more complicated
0 -
It's a meta-schema
0 -
Lol
0 -
I use that in my slides for ocsf when talking about it
0
