Skip to main content

other

Overview​

AlphaSOC normalizes other telemetry into the Open Cybersecurity Schema Framework (OCSF) format. The fields listed below are available for use in Sigma detection rules. For complete field definitions and semantics, refer to the linked OCSF class schema pages.

Base Event​

OCSF Category: Uncategorized

OCSF Class: Base Event

OCSF Fields

  • activity_id
  • activity_name
  • category_name
  • category_uid
  • class_name
  • class_uid
  • metadata.product.name
  • metadata.tenant_uid
  • metadata.version
  • raw_data
  • severity
  • severity_id
  • time
  • type_name
  • type_uid

Further Reading​