Standardize on OCSF to run your own detection rules?
Anyone adopted OCSF as their canonical logging schema?
Hoping to cut parsing overhead and make detection rule writing easier. Currently mapping 20-odd sources.
Any lessons/red flags you can share?
Hoping to cut parsing overhead and make detection rule writing easier. Currently mapping 20-odd sources.
Any lessons/red flags you can share?
No comments yet.