OCSF Schema Reference

Huntbase uses the Open Cybersecurity Schema Framework (OCSF) as its canonical data model for normalizing, storing, and querying security events across all connected data sources. This page documents how OCSF is applied in Huntbase, the supported event categories and classes, and how events are decomposed into the Huntbase graph structure.

What is OCSF?

OCSF is an open-source, vendor-agnostic schema framework for cybersecurity event data. It defines a standard set of event categories, classes, and attributes that allow security tools to produce and consume event data in a consistent format, regardless of the originating product.

Key principles of OCSF:

• Vendor-neutral -- Events from any product (CrowdStrike, AWS CloudTrail, Okta, Microsoft Defender, etc.) are mapped to the same schema
• Hierarchical -- Events are organized into categories, classes, and activity types
• Extensible -- Custom attributes and profiles can be added without breaking the base schema
• Observable-oriented -- First-class support for security observables (IPs, domains, hashes, users)

Huntbase implements OCSF v1.3. For the full upstream specification, see schema.ocsf.io.

How Huntbase uses OCSF

Event normalization

When Huntbase ingests data from a connected product, the raw events are mapped to the corresponding OCSF event class through normalization mappings. Each connection has a set of mappings that translate vendor-specific field names and values into OCSF-compliant attributes.

Raw event (vendor format)  -->  Normalization mapping  -->  OCSF event  -->  Surface

For example, an Okta user.session.start event and an AWS CloudTrail ConsoleLogin event both normalize to the OCSF Authentication class (3002), making them queryable through the same authentication surface with the same field names.

Insights and detection

Huntbase Insights (security findings) use OCSF event classes to:

• Classify findings by category and severity using OCSF's severity_id and type_uid fields
• Correlate events across data sources using shared OCSF attributes (e.g., user.name, src_endpoint.ip)
• Map to MITRE ATT&CK through OCSF's attacks array, which links events to tactics and techniques
• Extract entities by reading OCSF observable fields (IPs, domains, hashes, users) from normalized events

Surfaces

Surfaces in Huntbase are queryable views built on top of OCSF event classes. Each surface corresponds to one or more OCSF classes and exposes the OCSF attributes as columns. See Query languages for how to query this data, and use the schema tree in the query workspace to browse the datasets and columns available to you.

Supported event categories and classes

Huntbase supports the following OCSF event categories and classes. Each class maps to a Huntbase surface.

Identity and Access Management (Category 3)

Class ID	Class Name	Huntbase Surface	Description
3001	Account Change	authentication	Account creation, modification, deletion
3002	Authentication	authentication	Login, logout, authentication attempts
3003	Authorize Session	authentication	Session authorization and token grants
3004	Entity Management	authentication	User and group management events

System Activity (Category 1)

Class ID	Class Name	Huntbase Surface	Description
1001	File System Activity	file_activity	File create, read, update, delete operations
1003	Kernel Extension Activity	process_activity	Kernel module load and unload
1004	Kernel Activity	process_activity	Kernel-level operations
1007	Process Activity	process_activity	Process start, stop, injection, and access
1006	Module Activity	process_activity	Library and module load events

Network Activity (Category 4)

Class ID	Class Name	Huntbase Surface	Description
4001	Network Activity	network_activity	TCP/UDP connection events
4002	HTTP Activity	http_activity	HTTP request and response events
4003	DNS Activity	dns_activity	DNS query and response events
4004	DHCP Activity	network_activity	DHCP lease events
4005	RDP Activity	network_activity	Remote desktop protocol events
4008	Network File Activity	file_activity	SMB/NFS file access over the network
4009	Email Activity	email_activity	Email send, receive, and delivery events
4011	SSH Activity	network_activity	SSH connection and authentication events

Application Activity (Category 6)

Class ID	Class Name	Huntbase Surface	Description
6001	Web Resource Access	http_activity	Web application resource access
6002	Application Lifecycle	cloud_api	Application start, stop, install, remove
6003	API Activity	cloud_api	Cloud and SaaS API calls

Security Findings (Category 2)

Class ID	Class Name	Huntbase Surface	Description
2001	Security Finding	security_finding	Alerts, detections, and vulnerability findings
2002	Vulnerability Finding	security_finding	Vulnerability scan results

Discovery (Category 5)

Class ID	Class Name	Huntbase Surface	Description
5001	Device Inventory Info	cloud_api	Host and device inventory
5002	Device Config State	cloud_api	Configuration and compliance state
5019	Service Query	cloud_api	Cloud resource and service queries

OCSF base event attributes

Every OCSF event in Huntbase includes the following base attributes, regardless of class:

Attribute	Type	Description
activity_id	integer	Activity type identifier within the class
activity_name	string	Human-readable activity name (e.g., "Logon", "Create")
category_uid	integer	OCSF category identifier
class_uid	integer	OCSF class identifier
type_uid	integer	Unique event type = class_uid * 100 + activity_id
time	timestamp	Event timestamp in UTC
severity_id	integer	Severity (0=Unknown, 1=Informational, 2=Low, 3=Medium, 4=High, 5=Critical, 6=Fatal)
status_id	integer	Outcome status (0=Unknown, 1=Success, 2=Failure, 99=Other)
message	string	Event description
metadata	object	Source product, version, and processing metadata
observables	array	Extracted security observables (IPs, domains, hashes, users)

The metadata object

{
  "metadata": {
    "product": {
      "name": "CrowdStrike Falcon",
      "vendor_name": "CrowdStrike",
      "version": "6.45"
    },
    "version": "1.3.0",
    "uid": "event-unique-id",
    "original_time": "2026-02-19T14:32:00Z",
    "processed_time": "2026-02-19T14:32:05Z"
  }
}

The observables array

Observables are automatically extracted during normalization and used for entity creation in Huntbase:

{
  "observables": [
    {
      "name": "src_endpoint.ip",
      "type": "IP Address",
      "type_id": 2,
      "value": "198.51.100.23"
    },
    {
      "name": "user.name",
      "type": "User Name",
      "type_id": 4,
      "value": "jdoe"
    }
  ]
}

Event decomposition and graph structure

Huntbase decomposes OCSF events into a graph of interconnected entities and relationships. This graph structure enables pivoting, correlation, and investigation workflows.

Decomposition process

OCSF Event  -->  Entity extraction  -->  Graph nodes + edges

1. Entity extraction -- Observables from the event (IPs, users, hosts, files, processes) are extracted and deduplicated as graph nodes
2. Relationship creation -- Edges are created between entities based on the event context (e.g., "user authenticated to host", "process created file")
3. Temporal linking -- Events are linked in time order per entity, building an activity timeline

Graph node types

The graph holds more than the objects extracted from events. Alongside event-derived entities it carries vulnerability and threat-intelligence context, so a hunt can pivot from a process to the CVE it exploits or the ATT&CK technique it maps to. Common node types include:

Node Type	Source	Example
User / Account	user, actor.user, user_account	jdoe, SYSTEM
Device / Endpoint	device, src_endpoint, dst_endpoint	workstation-01
Process	process, parent_process	powershell.exe (pid: 4832)
File	file	payload.exe, SHA-256 hash
Hash	file.hashes, observables	SHA-256 / MD5 values
Domain / FQDN / Hostname	query.hostname, dst_endpoint.domain	example.com
IP Address	src_endpoint.ip, dst_endpoint.ip	198.51.100.23
URL / Email	url, email	https://example.com/x, [email protected]
Observable	observables[] (generic)	Any extracted observable not typed above
Indicator (IOC)	Threat-intelligence feeds, hunt findings	Known-bad IP, domain or hash
Vulnerability (CVE)	Vulnerability findings, CVE catalog	CVE-2024-3094
CWE / CAPEC / CPE	Vulnerability catalog	CWE-79, CAPEC-66, cpe:2.3:a:...
ATT&CK technique / group / software / mitigation / campaign	attacks[], ATT&CK knowledge base	T1059.001, G0016, S0002
Malware / Threat actor / Campaign	Threat-intelligence context	Named families and actors
Certificate / Windows registry / Scheduled job / Service	Event objects	HKLM\...\Run, svchost
Insight / Finding / Query / Hunt	Huntbase objects linked to the entities they touched	An insight, the query run that surfaced a row

Example graph decomposition

Given an OCSF Authentication event where user jdoe logs in from 198.51.100.23 to dc01.corp.local:

[User: jdoe] --authenticated_to--> [Endpoint: dc01.corp.local]
[User: jdoe] --sourced_from--> [IP: 198.51.100.23]
[IP: 198.51.100.23] --connected_to--> [Endpoint: dc01.corp.local]

Each edge carries the event timestamp, type_uid, and severity, so a hunt can follow who touched what, and when.

Data source to OCSF mapping

The table below shows how events from common data sources map to OCSF classes in Huntbase.

Data Source	Vendor Event	OCSF Class	Surface
CrowdStrike Falcon	ProcessRollup2	Process Activity (1007)	process_activity
CrowdStrike Falcon	DnsRequest	DNS Activity (4003)	dns_activity
CrowdStrike Falcon	NetworkConnect	Network Activity (4001)	network_activity
AWS CloudTrail	ConsoleLogin	Authentication (3002)	authentication
AWS CloudTrail	AssumeRole	Authorize Session (3003)	authentication
AWS CloudTrail	RunInstances	API Activity (6003)	cloud_api
Okta	user.session.start	Authentication (3002)	authentication
Okta	user.account.update_password	Account Change (3001)	authentication
Microsoft Defender	DeviceProcessEvents	Process Activity (1007)	process_activity
Microsoft Defender	DeviceNetworkEvents	Network Activity (4001)	network_activity
Microsoft Defender	DeviceFileEvents	File System Activity (1001)	file_activity
Google Workspace	login	Authentication (3002)	authentication
Google Workspace	admin	Entity Management (3004)	authentication
SentinelOne	threat	Security Finding (2001)	security_finding
Palo Alto Networks	traffic	Network Activity (4001)	network_activity
Palo Alto Networks	threat	Security Finding (2001)	security_finding

Mappings are managed through the Surfaces API. To view the current mappings for a connection, see the API Reference.

Example OCSF events

Authentication event

An OCSF Authentication event as it appears in Huntbase after normalization from an Okta login:

{
  "activity_id": 1,
  "activity_name": "Logon",
  "category_uid": 3,
  "class_uid": 3002,
  "type_uid": 300201,
  "time": "2026-02-19T09:15:32Z",
  "severity_id": 1,
  "severity": "Informational",
  "status_id": 1,
  "status": "Success",
  "message": "User jdoe successfully logged in from 198.51.100.23",
  "user": {
    "name": "jdoe",
    "email_addr": "[email protected]",
    "type_id": 1,
    "uid": "00u1a2b3c4d5e6f7g8"
  },
  "src_endpoint": {
    "ip": "198.51.100.23",
    "location": {
      "country": "US",
      "city": "San Francisco"
    }
  },
  "dst_endpoint": {
    "hostname": "login.corp.example.com",
    "svc_name": "Okta SSO"
  },
  "auth_protocol_id": 99,
  "auth_protocol": "SAML",
  "metadata": {
    "product": {
      "name": "Okta",
      "vendor_name": "Okta",
      "version": "2024.06.0"
    },
    "version": "1.3.0"
  },
  "observables": [
    { "name": "user.name", "type": "User Name", "type_id": 4, "value": "jdoe" },
    { "name": "src_endpoint.ip", "type": "IP Address", "type_id": 2, "value": "198.51.100.23" },
    { "name": "user.email_addr", "type": "Email Address", "type_id": 5, "value": "[email protected]" }
  ]
}

Process Activity event

A process creation event normalized from CrowdStrike Falcon:

{
  "activity_id": 1,
  "activity_name": "Launch",
  "category_uid": 1,
  "class_uid": 1007,
  "type_uid": 100701,
  "time": "2026-02-19T11:42:08Z",
  "severity_id": 3,
  "severity": "Medium",
  "status_id": 1,
  "status": "Success",
  "message": "Process powershell.exe launched by explorer.exe",
  "actor": {
    "user": {
      "name": "jdoe",
      "uid": "S-1-5-21-1234567890-1234567890-1234567890-1001"
    }
  },
  "process": {
    "name": "powershell.exe",
    "pid": 4832,
    "cmd_line": "powershell.exe -ExecutionPolicy Bypass -File C:\\Temp\\script.ps1",
    "file": {
      "name": "powershell.exe",
      "path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
      "hashes": [
        { "algorithm": "SHA-256", "value": "abc123def456..." }
      ]
    },
    "parent_process": {
      "name": "explorer.exe",
      "pid": 2104
    }
  },
  "device": {
    "hostname": "workstation-01",
    "os": {
      "name": "Windows",
      "version": "10.0.19045"
    }
  },
  "attacks": [
    {
      "tactic": {
        "uid": "TA0002",
        "name": "Execution"
      },
      "technique": {
        "uid": "T1059.001",
        "name": "PowerShell"
      }
    }
  ],
  "metadata": {
    "product": {
      "name": "CrowdStrike Falcon",
      "vendor_name": "CrowdStrike"
    },
    "version": "1.3.0"
  },
  "observables": [
    { "name": "actor.user.name", "type": "User Name", "type_id": 4, "value": "jdoe" },
    { "name": "process.name", "type": "Process Name", "type_id": 9, "value": "powershell.exe" },
    { "name": "device.hostname", "type": "Hostname", "type_id": 1, "value": "workstation-01" },
    { "name": "process.file.hashes.value", "type": "Hash", "type_id": 8, "value": "abc123def456..." }
  ]
}

DNS Activity event

A DNS query event normalized from a network sensor:

{
  "activity_id": 1,
  "activity_name": "Query",
  "category_uid": 4,
  "class_uid": 4003,
  "type_uid": 400301,
  "time": "2026-02-19T14:05:22Z",
  "severity_id": 1,
  "severity": "Informational",
  "status_id": 1,
  "status": "Success",
  "message": "DNS query for suspicious-domain.tk from 10.0.1.50",
  "src_endpoint": {
    "ip": "10.0.1.50",
    "hostname": "workstation-07"
  },
  "query": {
    "hostname": "suspicious-domain.tk",
    "type": "A",
    "class": "IN"
  },
  "answers": [
    {
      "rdata": "203.0.113.100",
      "type": "A",
      "class": "IN"
    }
  ],
  "metadata": {
    "product": {
      "name": "Palo Alto Networks",
      "vendor_name": "Palo Alto Networks"
    },
    "version": "1.3.0"
  },
  "observables": [
    { "name": "src_endpoint.ip", "type": "IP Address", "type_id": 2, "value": "10.0.1.50" },
    { "name": "query.hostname", "type": "Hostname", "type_id": 1, "value": "suspicious-domain.tk" },
    { "name": "answers.rdata", "type": "IP Address", "type_id": 2, "value": "203.0.113.100" }
  ]
}

Next steps

• Query languages -- Query OCSF data with SQLite, STIX 2.1 and the other supported languages
• Key Concepts -- Understand entities, insights, and the data lifecycle
• API Reference -- Manage surfaces, mappings, and schemas programmatically