Can this skill help with specific OCSF schema lookups?

Yes, it can spawn a specialized subagent to fetch OCSF schema documentation for event classes, objects, attributes, and profiles.

How does this skill handle validation?

It implements a testing phase using the ocsf::cast operator, which validates the output against the OCSF schema and emits warnings on any mismatches.

What is the primary goal of the mapping-to-ocsf skill?

The goal is to guide users through adding OCSF (Open Cybersecurity Schema Framework) mapping to a Tenzir TQL parsing pipeline to ensure security events are normalized and compliant.

Do I need an existing Tenzir parser to use this skill?

The skill includes a preliminary phase to check for an existing parser; if one doesn't exist, it will guide you through creating one first.

OCSF Mapping for Tenzir

Name: OCSF Mapping for Tenzir
Author: tenzir

bytenzir

•

보안 및 테스팅

Normalizes security events to the Open Cybersecurity Schema Framework (OCSF) within Tenzir TQL pipelines.

This skill provides a guided, multi-phase workflow for security engineers to map raw log data to the OCSF standard using Tenzir's TQL. It automates the process of identifying appropriate OCSF event classes, selecting relevant profiles (like Host or OSINT), and generating structured mapping operators. By integrating validation via the ocsf::cast operator and automated testing, it ensures that cybersecurity data is normalized, compliant, and ready for cross-platform interoperability within the Tenzir ecosystem.

주요 기능

01Guided OCSF target analysis and event class identification

02Structured mapping operator generation using industry-standard templates

03Automated schema validation and compliance testing

04Integrated changelog management via the tenzir-ship framework

053 GitHub stars

06Support for specialized OCSF profiles including Host, OSINT, and Network Proxy

사용 사례

01Converting proprietary firewall or EDR logs into normalized OCSF events

02Validating existing Tenzir parsing pipelines for OCSF compliance

03Standardizing disparate security data sources for unified cross-tool analytics

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add tenzir/claude-plugins mapping-to-ocsf

For use in Claude.ai and ChatGPT

Download Skill