Anyone adopted OCSF as their canonical logging schema?
Hoping to cut parsing overhead and make detection rule writing easier. Currently mapping 20-odd sources.
Any lessons/red flags you can share?
1–1 of 1 posts
Hoping to cut parsing overhead and make detection rule writing easier. Currently mapping 20-odd sources.
Any lessons/red flags you can share?