OCSF Detection Finding Schema and Examples

The OCSF (Open Cybersecurity Schema Framework) Detection Finding schema is an open-source, vendor-agnostic standard for security telemetry. This schema:

• Adheres to industry best practices for security event formatting.
• Provides comprehensive attack categorization and findings.
• Includes comprehensive event context and metadata.

The Detection Finding class

Detection Finding is class 2004 in the OCSF Findings category (category_uid: 2). The specification defines it as a class that "describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies."

When consuming these events, a handful of attributes carry most of the weight:

Attribute	Requirement	Purpose
finding_info	Required	Identity of the finding: uid, title, types, and MITRE ATT&CK® attacks.
severity_id	Required	Normalized severity of the finding.
is_alert	Recommended	Marks the finding as an alertable signal.
evidences	Recommended	Artifacts derived from the activity that triggered the detection.
finding_info.related_events	Optional	Events or other findings related to this one. These may or may not be in OCSF.
count	Optional	Events in the same logical group between start_time and end_time.

The boundary between evidences and related_events is the part the specification leaves softest: evidences are the artifacts a detection was drawn from, related events are the surrounding records, and in practice the line between "artifact" and "related record" is drawn differently by different producers. It is worth checking what any given source puts where before you write queries against either.

One source event, many detections

A single source event frequently triggers more than one detection. OCSF does not prescribe one representation for that case, so a producer has to choose between two shapes, and each one loses something:

• One finding per detection, each carrying the source data. Every detection is independently readable, but the source event is duplicated once per detection. On a noisy event with five detections, you store the payload five times.
• One finding carrying every detection. Nothing is duplicated, but the per-detection attributes — title, severity, finding_info.uid — have nowhere to live at the top level, so one event cannot render as several distinct alerts in a SIEM.

AlphaSOC emits both shapes and links them with a correlation ID, so neither trade-off has to be made at write time.

How AlphaSOC models this

AlphaSOC generates two types of OCSF events to efficiently represent multiple detections while maintaining compatibility with the OCSF specification. When a single source event triggers multiple detections (e.g., Detection X and Detection Y), the engine generates:

• One OCSF Finding Raw event: Contains the source event data and all associated detections.
• Multiple OCSF Finding events (one per detection): Represents individual detections without source data.

The diagram below shows how a single OCSF finding-raw event relates to multiple OCSF finding events through a shared correlation ID.

Both event types share the correlation ID, enabling easy tracking between source events and their corresponding findings. This split structure ensures proper rendering of individual detection attributes (title, severity, description) while preserving complete context for analysis and optimizing storage usage by avoiding duplicate source data across multiple findings.

OCSF Finding Raw

OCSF Finding Raw events contain comprehensive source event data along with all associated detections. These events serve as the primary reference point for full context analysis. For an example event, refer to the OCSF Finding Raw Example.

Key Fields

Field	Description
metadata.event_code	finding-raw
metadata.correlation_uid	Link to OCSF Finding events
finding_info.uid	Unique identifier for the specific finding-raw event
finding_info.related_events[]	All generated detections and references to finding events
evidences[]	Derived artifacts from source events
count	Total source events (before sampling)
severity	Maximum severity across all generated detections for this event
is_alert	true when severity_id is 4 or 5; omitted otherwise

OCSF Finding

OCSF Finding events represent individual detections with focused information about specific security findings. Each event contains a single detection's details without duplicating source event data. For an example event, refer to the OCSF Finding Example.

Key Fields

Field	Description
metadata.event_code	finding
metadata.correlation_uid	Link to OCSF Finding Raw event
finding_info.uid	Unique identifier for the specific finding and detection
count	Total source events (before sampling)
title	Detection title
severity	Detection severity
is_alert	true when severity_id is 4 or 5; omitted otherwise

Correlation ID

The correlation ID links OCSF Finding Raw events with their corresponding OCSF Finding events, enabling two investigation approaches:

• From Finding event: Use correlation ID to access source event and related detections.
• From Finding Raw event: Use related events list to examine individual detections.

This bidirectional correlation allows efficient access to both detection details and source evidence during investigations.

Alertable Findings

Both event types set is_alert to true when severity_id is 4 (High) or 5 (Critical). Below that the attribute is omitted rather than set to false.

Two consequences are worth knowing before you query it:

• A Finding Raw event and its own Finding events can both be flagged, since the raw event inherits the maximum severity of its detections. Filtering on is_alert alone therefore counts one detection twice. Pair it with metadata.event_code = 'finding' to count detections, or metadata.event_code = 'finding-raw' to count source events.
• Because the attribute is omitted below the threshold, is_alert = false matches nothing. Use is_alert IS NOT TRUE to select findings under the threshold.

Sampling

AlphaSOC groups findings logically and applies sampling within these groups. The count field in both Finding Raw and Finding events indicates the total number of source events in the logical group before sampling was applied. This matches the OCSF definition of count — events in the same logical group between start_time and end_time — so a consumer that sums count sees true source volume rather than the number of records AlphaSOC escalated.

OCSF Detection Finding Examples

Both examples below are complete, unedited Detection Finding records at OCSF schema version 1.5.0 — the same events AlphaSOC delivers over the transports listed at the end of this page.

OCSF Finding Raw Example

Below is an example of an OCSF Finding Raw event containing two detections (suspicious_http_post and suspicious_domain) that share the same correlation ID abe76dab-cd9c-4cb5-b6e2-9e15f7b46406:

{
  "category_name": "Findings",
  "category_uid": 2,
  "class_name": "Detection Finding",
  "class_uid": 2004,
  "count": 1,
  "metadata": {
    "correlation_uid": "abe76dab-cd9c-4cb5-b6e2-9e15f7b46406",
    "event_code": "finding-raw",
    "labels": [
      "domain:network"
    ],
    "processed_time": 1754316019,
    "processed_time_dt": "2025-08-04T14:00:19Z",
    "product": {
      "vendor_name": "AlphaSOC"
    },
    "profiles": [
      "datetime"
    ],
    "version": "1.5.0"
  },
  "observables": [
    {
      "name": "evidences[].http_request.url.hostname",
      "type": "Hostname",
      "type_id": 1,
      "value": "ewubo.net"
    },
    {
      "name": "evidences[].http_request.url.url_string",
      "type": "URL String",
      "type_id": 6,
      "value": "http://ewubo.net/gate.php"
    },
    {
      "name": "evidences[].src_endpoint.hostname",
      "type": "Hostname",
      "type_id": 1,
      "value": "win-muvpgc-hw"
    },
    {
      "name": "evidences[].src_endpoint.ip",
      "type": "IP Address",
      "type_id": 2,
      "value": "10.200.91.2"
    },
    {
      "name": "evidences[].src_endpoint.mac",
      "type": "MAC Address",
      "type_id": 3,
      "value": "ca:2f:e2:4d:58:aa"
    }
  ],
  "severity": "High",
  "severity_id": 4,
  "time": 1754316019,
  "time_dt": "2025-08-04T14:00:19Z",
  "type_name": "Detection Finding: Create",
  "type_uid": 200401,
  "activity_id": 1,
  "activity_name": "Create",
  "device": {
    "mac": "ca:2f:e2:4d:58:aa",
    "hostname": "win-muvpgc-hw",
    "ip": "10.200.91.2",
    "type_id": 0
  },
  "end_time": 1754315299,
  "end_time_dt": "2025-08-04T13:48:19Z",
  "finding_info": {
    "related_events": [
      {
        "severity": "High",
        "severity_id": 4,
        "tags": [
          {
            "name": "detection_id",
            "value": "suspicious_http_post"
          }
        ],
        "title": "HTTP POST to a known bad destination indicating infection",
        "type_name": "Detection Finding: Create",
        "type_uid": 200401,
        "uid": "abe76dab-cd9c-4cb5-b6e2-9e15f7b46406-suspicious_http_post"
      },
      {
        "severity": "Low",
        "severity_id": 2,
        "tags": [
          {
            "name": "detection_id",
            "value": "suspicious_domain"
          }
        ],
        "title": "Traffic to a suspicious domain",
        "type_name": "Detection Finding: Create",
        "type_uid": 200401,
        "uid": "abe76dab-cd9c-4cb5-b6e2-9e15f7b46406-suspicious_domain"
      }
    ],
    "title": "AlphaSOC findings",
    "uid": "abe76dab-cd9c-4cb5-b6e2-9e15f7b46406"
  },
  "start_time": 1754315299,
  "start_time_dt": "2025-08-04T13:48:19Z",
  "evidences": [
    {
      "data": {
        "event": {
          "type": "http",
          "ts": "2025-08-04T13:46:51Z",
          "srcIP": "10.200.91.2",
          "srcHost": "win-muvpgc-hw",
          "srcMac": "ca:2f:e2:4d:58:aa",
          "metadata": {
            "eventID": 12867006424215262491
          },
          "dataOrigin": "alphasoc-http",
          "body": {
            "url": "http://ewubo.net/gate.php",
            "method": "post",
            "status": 200,
            "app": "Nginx",
            "action": "ok",
            "bytesIn": 29113,
            "bytesOut": 5716,
            "contentType": "",
            "referrer": "",
            "userAgent": "Mozilla/4.0 (compatible; MSIE 7.0; OS 7.0; Trident/3.1; IEMobile/7.0)"
          }
        },
        "wisdom": {
          "flags": [
            "unique"
          ],
          "domain": "ewubo.net",
          "whois": {
            "creationTime": "2016-04-27T18:57:41Z"
          }
        }
      },
      "http_request": {
        "http_headers": [
          {
            "name": "User-Agent",
            "value": "Mozilla/4.0 (compatible; MSIE 7.0; OS 7.0; Trident/3.1; IEMobile/7.0)"
          }
        ],
        "http_method": "POST",
        "length": 5716,
        "url": {
          "hostname": "ewubo.net",
          "path": "/gate.php",
          "scheme": "http",
          "url_string": "http://ewubo.net/gate.php"
        }
      },
      "http_response": {
        "code": 200,
        "length": 29113
      },
      "src_endpoint": {
        "hostname": "win-muvpgc-hw",
        "ip": "10.200.91.2",
        "mac": "ca:2f:e2:4d:58:aa"
      }
    }
  ],
  "is_alert": true
}

...

OCSF Finding Example

Below is an example of an OCSF Finding event generated from the Finding Raw example above:

{
  "category_name": "Findings",
  "category_uid": 2,
  "class_name": "Detection Finding",
  "class_uid": 2004,
  "count": 1,
  "metadata": {
    "correlation_uid": "abe76dab-cd9c-4cb5-b6e2-9e15f7b46406",
    "event_code": "finding",
    "labels": [
      "domain:network"
    ],
    "processed_time": 1754316019,
    "processed_time_dt": "2025-08-04T14:00:19Z",
    "product": {
      "vendor_name": "AlphaSOC"
    },
    "profiles": [
      "datetime"
    ],
    "version": "1.5.0"
  },
  "observables": [
    {
      "name": "device.mac",
      "type": "MAC Address",
      "type_id": 3,
      "value": "ca:2f:e2:4d:58:aa"
    },
    {
      "name": "device.hostname",
      "type": "Hostname",
      "type_id": 1,
      "value": "win-muvpgc-hw"
    },
    {
      "name": "device.ip",
      "type": "IP Address",
      "type_id": 2,
      "value": "10.200.91.2"
    }
  ],
  "severity": "High",
  "severity_id": 4,
  "time": 1754316019,
  "time_dt": "2025-08-04T14:00:19Z",
  "type_name": "Detection Finding: Create",
  "type_uid": 200401,
  "activity_id": 1,
  "activity_name": "Create",
  "device": {
    "mac": "ca:2f:e2:4d:58:aa",
    "hostname": "win-muvpgc-hw",
    "ip": "10.200.91.2",
    "type_id": 0
  },
  "end_time": 1754315299,
  "end_time_dt": "2025-08-04T13:48:19Z",
  "finding_info": {
    "attacks": [
      {
        "tactic": {
          "uid": "TA0010"
        },
        "technique": {
          "uid": "T1041"
        }
      },
      {
        "sub_technique": {
          "uid": "T1071.001"
        },
        "tactic": {
          "uid": "TA0011"
        },
        "technique": {
          "uid": "T1071"
        }
      }
    ],
    "created_time": 1754316019,
    "created_time_dt": "2025-08-04T14:00:19Z",
    "title": "HTTP POST to a known bad destination indicating infection",
    "types": [
      "suspicious_http_post"
    ],
    "uid": "abe76dab-cd9c-4cb5-b6e2-9e15f7b46406-suspicious_http_post"
  },
  "start_time": 1754315299,
  "start_time_dt": "2025-08-04T13:48:19Z",
  "is_alert": true
}

...

Where these findings go next

The events above are delivered unchanged over the transports that carry the OCSF format:

Destination	Notes
Amazon S3	Object storage, including Amazon Security Lake
Cribl	Routing to any downstream destination
Kafka	Streaming to your own consumers

Related

• OCSF field mappings — how source telemetry is normalized into OCSF classes before any detection runs, including network and system events.
• OCSF support for Sigma — write detection rules against OCSF field names instead of vendor-specific ones.
• Escalation overview — how findings leave the platform.