Collect OCSF logs

This document describes the supported event types for OCSF logs and how log fields map to Google SecOps Unified Data Model (UDM) fields.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the OCSF ingestion label.

Supported OCSF log formats

The OCSF parser supports logs in JSON format.

Supported OCSF Sample Logs

• JSON:

  {
  "activity_id": 1,
  "activity_name": "Logon",
  "certificate": {
    "created_time": 1602175307000,
    "expiration_time": 1602175307000,
    "issuer": "dummy",
    "serial_number": "1234567",
    "subject": "user",
    "version": "1"
  },
  "auth_protocol": "NTLM",
  "auth_protocol_id": 1,
  "category_name": "Audit Activity",
  "category_uid": 3,
  "class_name": "Authentication",
  "class_uid": 3002,
  "device": {
    "hostname": "dummy_hostname",
    "hw_info": {
      "bios_manufacturer": "bios_manufacturer",
      "cpu_cores": 42,
      "cpu_speed": 4200,
      "cpu_type": "x86 Family 6 Model 37 Stepping 5",
      "ram_size": 2048,
      "serial_number": "serial123"
    },
    "location": {
      "coordinates": [
        -73.983,
        40.719
      ],
      "city": "city",
      "country": "country",
      "region": "region"
    },
    "os": {
      "name": "Windows",
      "type": "Windows",
      "type_id": 100
    },
    "type": "Unknown",
    "type_id": 2
  },
  "dst_endpoint": {
    "hostname": "dummy_hostname",
    "domain": "dummy@domain.com",
    "uid": "123456789",
    "ip": "198.51.100.4",
    "intermediate_ips": [
      "198.51.100.5",
      "198.51.100.6"
    ],
    "mac": "47-1E-10-E7-2B-D0",
    "port": 420,
    "location": {
      "coordinates": [
        -73.983,
        40.719
      ],
      "city": "city",
      "country": "country",
      "region": "region"
    }
  },
  "actor": {
    "process": {
      "created_time": 1538087851000,
      "parent_process": {
        "cmd_line": "actor_parent_process_cmd_line"
      },
      "file": {
        "name": "-",
        "path": "-",
        "type": "Regular File",
        "type_id": 1,
        "accessed_time": 1538087851000,
        "created_time": 1538087851000,
        "modified_time": 1538087851000,
        "mime_type": "actor_file_type",
        "size": 45
      },
      "pid": 0,
      "cmd_line": "actor_process_cmd_line",
      "uid": "456"
    },
    "session": {
      "uid": "0x0"
    },
    "user": {
      "account_type": "Windows Account",
      "account_type_id": 2,
      "domain": "-",
      "name": "-",
      "uid": "NULL SID"
    }
  },
  "logon_type": "Network",
  "logon_type_id": 3,
  "message": "An account failed to log on.",
  "metadata": {
    "original_time": "10/08/2020 12:41:47 PM",
    "product": {
      "feature": {
        "name": "Security"
      },
      "name": "Microsoft Windows",
      "vendor_name": "Microsoft"
    },
    "profiles": [
      "host"
    ],
    "uid": "a738d6e6-4ebd-49bb-805e-45d0604a1bef",
    "version": "1.0.0-rc.2"
  },
  "severity": "Informational",
  "severity_id": 1,
  "src_endpoint": {
    "hostname": "dummy_hostname",
    "domain": "dummy@domain.com",
    "ip": "198.51.100.4",
    "intermediate_ips": [
      "198.51.100.5",
      "198.51.100.6"
    ],
    "mac": "00:1b:63:84:45:e6",
    "port": 420,
    "location": {
      "coordinates": [
        -73.983,
        40.719
      ],
      "city": "city",
      "country": "country",
      "region": "region"
    }
  },
  "status": "0xC000006D",
  "status_detail": "Unknown user name or bad password.",
  "status_id": 2,
  "time": 1602175307000,
  "type_name": "Authentication: Logon",
  "type_uid": 300201,
  "unmapped": {
    "Detailed Authentication Information": {
      "Key Length": "0",
      "Package Name (NTLM only)": "-",
      "Transited Services": "-"
    },
    "EventCode": "4625",
    "EventType": "0",
    "Failure Information": {
      "Sub Status": "0xC000006A"
    },
    "OpCode": "Info",
    "RecordNumber": "223742",
    "SourceName": "Microsoft Windows security auditing.",
    "TaskCategory": "Logon"
  },
  "user": {
    "account_type": "Windows Account",
    "account_type_id": 2,
    "domain": "dummy.domain.com",
    "name": "Administrator",
    "uid": "NULL SID"
  }
  }
  

Field mapping reference

Field mapping reference: Event Identifier to Event Type

The following table lists the OCSF Supported Events log types and their corresponding UDM event types.

Field mapping reference: OCSF Authentication

The following table lists the log fields for the Authentication log type and their corresponding UDM fields.

Field mapping reference: OCSF Authorize Session

The following table lists the log fields for the Authorize Session log type and their corresponding UDM fields.

Field mapping reference: OCSF Security Finding

The following table lists the log fields for the Security Finding log type and their corresponding UDM fields.

Field mapping reference: OCSF FTP Activity

The following table lists the log fields for the FTP Activity log type and their corresponding UDM fields.

Field mapping reference: OCSF Compliance Finding

The following table lists the log fields for the Compliance Finding log type and their corresponding UDM fields.

Field mapping reference: OCSF Detection Finding

The following table lists the log fields for the Detection Finding log type and their corresponding UDM fields.

Field mapping reference: OCSF Incident Finding

The following table lists the log fields for the Incident Finding log type and their corresponding UDM fields.

Field mapping reference: OCSF Vulnerability Finding

The following table lists the log fields for the Vulnerability Finding log type and their corresponding UDM fields.

Field mapping reference: OCSF Process Activity

The following table lists the log fields for the Process Activity log type and their corresponding UDM fields.

Field mapping reference: OCSF Http Activity

The following table lists the log fields for the Http Activity log type and their corresponding UDM fields.

Field mapping reference: OCSF Network Activity

The following table lists the log fields for the Network Activity log type and their corresponding UDM fields.

Field mapping reference: OCSF Network File Activity

The following table lists the log fields for the Network File Activity log type and their corresponding UDM fields.

Field mapping reference: OCSF File Hosting Activity

The following table lists the log fields for the File Hosting Activity log type and their corresponding UDM fields.

Field mapping reference: OCSF API Activity

The following table lists the log fields for the API Activity log type and their corresponding UDM fields.

Field mapping reference: OCSF DNS Activity

The following table lists the log fields for the DNS Activity log type and their corresponding UDM fields.

Need more help? Get answers from Community members and Google SecOps professionals.