WIP - Markdown Mappings by Hunters

[OmerGull]

Hi team, as part of our larger effort of adopting OCSF as our base data-model, we're happy to contribute the following mappings.

Note:

• Mappings are still not validated - some required fields might be missing.
• Sample fields are still not available.

While this is not ideal and we are planning to address both in the next few weeks, we thought the community could still benefit from it

Provided mappings

• alibaba_actiontrail_3002_authentication - V1.1.0
• alibaba_slb_logs_4002_http_activity - V1.1.0
• alibaba_waf_4002_http_activity - V1.1.0
• axis_activity_logs_4003_dns_activity - V1.1.0
• azure_signin_3002_authentication - V1.1.0
• beyondtrust_events_1007_process_activity - V1.1.0
• beyondtrust_passwordsafe_3002_authentication - V1.1.0
• bind_dns_events_4003_dns_activity - V1.1.0
• bind_dns_logs_4003_dns_activity - V1.1.0
• cato_networks_security_events_4001_network_activity - V1.1.0
• cb_platform_devices_5001_inventory_info - V1.1.0
• cb_platform_events_1001_file_activity - V1.1.0
• cb_platform_events_1007_process_activity - V1.1.0
• cb_platform_events_201001_win_registry_key_activity - V1.1.0
• cb_platform_events_201002_win_registry_value_activity - V1.1.0
• cb_platform_events_4001_network_activity - V1.1.0
• checkpoint_traffic_4001_network_activity - V1.1.0
• cisco_asa_firewall_4001_network_activity - V1.1.0
• cisco_ftd_firewall_4001_network_activity - V1.1.0
• cisco_umbrella_dns_logs_4003_dns_activity - V1.1.0
• cloudflare_dns_4003_dns_activity - V1.1.0
• cloudflare_http_4002_http_activity - V1.1.0
• cybereason_sensors_5001_inventory_info - V1.1.0
• duo_authentication_logs_3002_authentication - V1.1.0
• fortinet_firewall_4001_network_activity - V1.1.0
• gcp_audit_4002_http_activity - V1.1.0
• github_server_logs_4002_http_activity - V1.1.0
• iboss_web_activity_4002_http_activity - V1.1.0
• iis_w3c_4002_http_activity - V1.1.0
• imperva_waf_logs_4002_http_activity - V1.1.0
• infoblox_bloxone_dns_4003_dns_activity - V1.1.0
• infoblox_nios_dns_4003_dns_activity - V1.1.0
• island_browser_devices_5001_inventory_info - V1.1.0
• jamf_computers_5001_inventory_info - V1.1.0
• lansweeper_assets_5001_inventory_info - V1.1.0
• mdatp_device_file_events_1001_file_activity - V1.1.0
• mdatp_device_info_5001_inventory_info - V1.1.0
• mdatp_device_logon_events_3002_authentication - V1.1.0
• mdatp_device_network_events_4001_network_activity - V1.1.0
• mdatp_device_process_events_1007_process_activity - V1.1.0
• mdatp_device_registry_events_201001_win_registry_key_activity - V1.1.0
• mdatp_device_registry_events_201002_win_registry_value_activity - V1.1.0
• netiq_edirectory_audit_3002_authentication - V1.1.0
• o365_audit_logs_3002_authentication - V1.1.0
• okta_logs_3002_authentication - V1.1.0
• onelogin_events_3002_authentication - V1.1.0
• oracle_audit_logs_3002_authentication - V1.1.0
• oracle_service_logs_4001_network_activity - V1.1.0
• oracle_service_logs_4002_http_activity - V1.1.0
• osquery_logs_1007_process_activity - V1.1.0
• osquery_logs_4001_network_activity - V1.1.0
• pan_cortex_xdr_endpoints_5001_inventory_info - V1.1.0
• pan_edr_raw_logs_1001_file_activity - V1.1.0
• pan_edr_raw_logs_1007_process_activity - V1.1.0
• pan_edr_raw_logs_201001_win_registry_key_activity - V1.1.0
• pan_edr_raw_logs_201002_win_registry_value_activity - V1.1.0
• pan_edr_raw_logs_4001_network_activity - V1.1.0
• pan_firewall_globalprotect_3002_authentication - V1.1.0
• pan_firewall_traffic_4001_network_activity - V1.1.0
• pfsense_filter_logs_4001_network_activity - V1.1.0
• route53_resolver_query_logs_4003_dns_activity - V1.1.0
• sentinelone_agents_5001_inventory_info - V1.1.0
• sentinelone_raw_events_v2_1001_file_activity - V1.1.0
• sentinelone_raw_events_v2_1007_process_activity - V1.1.0
• sentinelone_raw_events_v2_201001_win_registry_key_activity - V1.1.0
• sentinelone_raw_events_v2_201002_win_registry_value_activity - V1.1.0
• sentinelone_raw_events_v2_4001_network_activity - V1.1.0
• signal_sciences_events_4002_http_activity - V1.1.0
• signal_sciences_requests_4002_http_activity - V1.1.0
• silverpeak_firewall_logs_4001_network_activity - V1.1.0
• skyhigh_webgateway_alerts_4002_http_activity - V1.1.0
• slack_audit_logs_3002_authentication - V1.1.0
• squid_proxy_logs_4002_http_activity - V1.1.0
• symantec_cloud_secure_web_gateway_logs_4002_http_activity - V1.1.0
• universal_wel_201001_win_registry_key_activity - V1.1.0
• universal_wel_201002_win_registry_value_activity - V1.1.0
• universal_wel_4003_dns_activity - V1.1.0
• vectra_metadata_logs_4001_network_activity - V1.1.0
• vectra_metadata_logs_4002_http_activity - V1.1.0
• vectra_metadata_logs_4003_dns_activity - V1.1.0
• windows_dns_debug_logs_4003_dns_activity - V1.1.0
• zeek_conn_logs_4001_network_activity - V1.1.0
• zeek_dns_logs_4003_dns_activity - V1.1.0
• zscaler_zia_4002_http_activity - V1.1.0
• zscaler_zia_dns_4003_dns_activity - V1.1.0

[floydtree]

hey @OmerGull based on our initial conversation, you/your team was looking into OCSF validation of these mappings. Were you able to complete the validation? It would be good to get this PR merged and have these mappings available in the repo.

[OmerGull]

Hi @floydtree, sadly we have yet to complete it.
We do have many more sources to share (we are nearing 300) but can't share any samples nor validate that all required fields do exist.
How do you recommend we continue?