Map Security posture events to OCSF

The Open Cybersecurity Schema Framework (OCSF) is an open schema for security events. Apply this mapping to Security posture activities in your own pipeline, after you read them and before you store them. To ingest them into your security information and event management (SIEM) system, start at Send Security posture events to your SIEM.

OCSF version

This mapping uses OCSF 1.6.0. If you validate against another version, check the attributes on this page against that version. For example, in OCSF 1.7.0, metadata.uid is the identifier of the OCSF event itself, and metadata.original_event_uid holds the identifier from the source. OCSF 1.9.0 deprecates actor.app_name in favor of actor.application.

Attributes for every Security posture activity

Map these fields on every event.

Put every field that has no OCSF attribute in the unmapped object under its Activity Feed name, including fields that your handler does not recognize. Where a field is absent or null, leave out the OCSF attribute.

Map the actor object:

Attestation activities: Entity Management

Map an org_security_control_attestation_updated activity to the OCSF Entity Management class (3004). Entity Management events report an operation on a managed entity, here the organization’s attestation for a security control.

Do not map status to status_id or to any pass or fail value: an attestation is a person’s statement about a control, not the result of a check.

For 99 (Other), set activity_name to the action value.

An attested activity maps to an event like this one, with sample values:

{
  "class_uid": 3004,
  "category_uid": 3,
  "activity_id": 1,
  "type_uid": 300401,
  "severity_id": 1,
  "time": 1794495872517,
  "metadata": {
    "version": "1.6.0",
    "profiles": ["host"],
    "uid": "activity_01Kp5RvNd8Wc3TgMy6BxQf4Z",
    "event_code": "org_security_control_attestation_updated",
    "original_time": "2026-11-12T15:04:32.517208Z",
    "logged_time": 1794495910000,
    "tenant_uid": "91012d09-e48b-438e-a489-1bebfd8fa6f9",
    "product": { "vendor_name": "Anthropic", "name": "Compliance API" }
  },
  "actor": {
    "user": {
      "uid": "user_01TuVwXyZaBcDeFgH2JkLmN4",
      "email_addr": "admin@example.com"
    }
  },
  "src_endpoint": { "ip": "192.0.2.34" },
  "http_request": { "user_agent": "ExampleBrowser/1.0" },
  "entity": {
    "type_id": 99,
    "type": "Security control attestation",
    "uid": "mdm_chat_required_organization",
    "data": { "status": "completed" }
  },
  "unmapped": {
    "action": "attested",
    "actor": { "type": "user_actor" },
    "organization_id": "org_01JuY4bkwkH1x4PodBJaWmh2"
  }
}