What is OCSF?

Summary

• What it is. OCSF — the Open Cybersecurity Schema Framework — is an open standard for normalizing security event and log data into a common schema.
• Its purpose. It lets organizations bring together heterogeneous security telemetry from many sources (endpoint, network, identity, and cloud logs) and normalize it into a unified format for correlation, analysis, and threat detection.
• Why it helps. Because it is an open, vendor-neutral schema, OCSF reduces manual data-transformation work and helps organizations avoid lock-in to proprietary formats.
• On Databricks. OCSF is a core part of the Databricks security lakehouse strategy: Lakewatch, the Databricks agentic SIEM, uses OCSF to normalize disparate sources into a common schema for analysis, keeping data in open formats in your own cloud storage.
• Learn more. See Databricks announces Lakewatch, a new agentic SIEM.

What is OCSF?

OCSF (the Open Cybersecurity Schema Framework) is an open standard for normalizing security event and log data into a common schema. Security teams collect telemetry from many different systems — endpoints, networks, identity providers, cloud services, and more — and each source describes events in its own format. OCSF defines a shared, vendor-neutral way to represent those events so they can be correlated and analyzed together.
The purpose of OCSF is to let organizations ingest heterogeneous security data and normalize it into a unified format for correlation, analysis, and threat detection — without being locked into any one vendor's proprietary schema. Because the framework is open, it reduces the manual data-transformation work that traditionally slows security analytics down.

How Databricks and Lakewatch support OCSF

OCSF is a core component of the Databricks security lakehouse strategy, and it is central to Lakewatch, the Databricks agentic SIEM.

• Automated OCSF normalization. Lakewatch provides automated OCSF mapping to normalize disparate data sources into a common schema for immediate correlation, so security teams don't have to hand-build transformations for every source.
• Progressive normalization. Lakewatch uses OCSF as the standardized "gold" schema in a medallion architecture, letting teams normalize data progressively rather than requiring everything to be converted up front.
• Automated ingestion. Lakewatch uses Lakeflow Connect to ingest and normalize major security sources into standardized, OCSF-aligned tables, reducing manual data engineering.
• Agents that understand OCSF. Security agents in Lakewatch are trained on OCSF semantics, so they can reason over normalized telemetry to support threat hunting and triage across large volumes of data.
• An open data foundation. Because Lakewatch is built on OCSF and open formats, data stays in open table formats such as Delta Lake or Apache Iceberg in your own cloud storage — so organizations keep ownership of their security data and avoid proprietary lock-in.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM for how OCSF fits the security lakehouse.
• See When alert fatigue becomes a business risk for how normalized security data supports detection and triage.

FAQs

What does OCSF stand for?

OCSF stands for the Open Cybersecurity Schema Framework, an open standard for normalizing security event and log data into a common schema.

What problem does OCSF solve?

Security telemetry arrives in many different formats from many sources. OCSF provides a shared, vendor-neutral schema so that data can be normalized once and then correlated and analyzed together.

How does Databricks use OCSF?

Databricks uses OCSF as a core part of its security lakehouse, and Lakewatch — the Databricks agentic SIEM — uses OCSF to normalize disparate sources into a common schema while keeping data in open formats in your own cloud storage.