What is OCSF normalization and why does it matter for SOC teams?

Summary

• OCSF normalization maps security telemetry from many different sources — endpoint, network, identity, and cloud logs — into the Open Cybersecurity Schema Framework (OCSF), a single open, standardized data model.
• It matters for SOC teams because unnormalized telemetry sits in silos, forcing analysts to correlate signals by hand across disconnected systems and leaving visibility gaps that attackers exploit.
• With a common schema, detections, analytics, and AI agents can all reason over heterogeneous telemetry consistently, so an alert can be correlated across endpoint, network, identity, and cloud signals in minutes.
• Databricks Lakewatch, an agentic SIEM built on the Data Intelligence Platform, automates OCSF mapping so incoming logs land in a common schema ready for immediate correlation and detection.
• Lakewatch uses a medallion architecture in which OCSF-normalized data becomes the governed "gold" layer for out-of-the-box detections, all governed by Unity Catalog and queryable in plain English with AI/BI Genie.

What is OCSF normalization and why does it matter for SOC teams?

The Open Cybersecurity Schema Framework (OCSF) is an open, standardized schema for security data. OCSF normalization is the process of mapping telemetry from many different sources — endpoint, network, identity, and cloud logs — into that one common data model. It matters for security operations center (SOC) teams because raw security data arrives in many formats and typically ends up fragmented across tools. When telemetry is not normalized, analysts have to correlate signals by hand across disconnected systems, and the gaps that result leave blind spots that sophisticated threat actors exploit. A common schema removes that friction: detections, analytics, and AI agents can all reason over heterogeneous telemetry in a consistent way, so an alert can be correlated against endpoint, network, identity, and cloud signals in minutes.

Why Databricks Lakewatch for OCSF normalization

Databricks Lakewatch is an agentic SIEM built on the Databricks Data Intelligence Platform. It makes OCSF normalization automatic and puts the normalized data to work.

• Automated OCSF mapping. Lakewatch normalizes disparate sources — endpoint, network, identity, and cloud logs — into a common OCSF schema for immediate correlation, so analysts do not have to hand-build parsers for every log source.
• Medallion architecture with an OCSF gold layer. OCSF-normalized data becomes the governed "gold" layer that powers out-of-the-box detections and analytics. Bronze-layer data stays usable for detection rules and monitoring, so teams normalize to gold where it adds the most value.
• Out-of-the-box ingestion. Lakeflow Connect provides a large library of connectors to ingest telemetry from major security sources and land it in standardized tables.
• Correlation across a unified lakehouse. Storing all security telemetry in one open lakehouse alongside business and application data lets teams correlate across any source without moving files or switching tools.
• Natural-language threat hunting. AI/BI Genie lets security teams query the normalized data in plain English and translates those questions into SQL, so hunting is not limited to specialists.
• Governance and audit. Unity Catalog governs the data and logs queries and autonomous agent actions, providing an audit and forensic trail for compliance and post-incident investigation.

Lakewatch is available in Private Preview.

Getting started

• Read Databricks Announces Lakewatch: a new, agentic SIEM for the architecture, including OCSF normalization.
• Read Alert fatigue is a business risk for why unified, normalized telemetry reduces manual correlation.
• Explore the Data Intelligence Platform to see how ingestion, detection, and governance fit together.

FAQs

What does OCSF stand for?

OCSF is the Open Cybersecurity Schema Framework, an open, standardized schema that defines a common data model for security telemetry so data from different tools can be analyzed together.

Why does OCSF normalization matter for SOC teams?

Without a common schema, security data stays siloed across endpoint, network, identity, and cloud tools, forcing manual correlation and leaving blind spots. Normalizing to OCSF lets analysts and AI agents correlate signals across all sources consistently.

Does Databricks normalize security data to OCSF automatically?

Yes. Lakewatch automates OCSF mapping so endpoint, network, identity, and cloud logs land in a common schema, with OCSF-normalized data forming the governed gold layer for detections and analytics.