Ocsf.Schema 1.9.0

Ocsf.Schema

Strongly-typed C# classes for the Open Cybersecurity Schema Framework (OCSF) v1.9.0.

This package provides:

• 84 event classes (ProcessActivity, DnsActivity, Authentication, and more)
• 177 object types (Process, Device, User, File, Actor, and more)
• 124 enums (SeverityId, StatusId, per-event ActivityId values, and more)
• Platform extensions for Windows, Linux, and macOS
• System.Text.Json serialization with [JsonPropertyName] on every property
• Constraint validation via OcsfValidator

Getting Started

using System.Text.Json;
using Ocsf.Schema;
using Ocsf.Schema.Events;
using Ocsf.Schema.Objects;

// Create an event
var evt = new ProcessActivity
{
    Time = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds(),
    SeverityId = 1,
    CategoryUid = 1,
    ClassUid = 107,
    TypeUid = 100701,
    ActivityId = 1, // Launch
    Process = new Process
    {
        Pid = 1234,
        Name = "notepad.exe"
    },
    Metadata = new Metadata { Version = "1.9.0-dev" }
};

// Serialize — null fields are omitted, property names are snake_case
var options = OcsfSerializerOptions.Create();
string json = JsonSerializer.Serialize(evt, options);

// Deserialize
var deserialized = JsonSerializer.Deserialize<ProcessActivity>(json, options);

Polymorphic Deserialization

Use OcsfEventRegistry to resolve a concrete event type from class_uid:

using var doc = JsonDocument.Parse(json);
int classUid = doc.RootElement.GetProperty("class_uid").GetInt32();
Type? eventType = OcsfEventRegistry.GetEventType(classUid);

if (eventType is not null)
{
    object? evt = JsonSerializer.Deserialize(json, eventType, options);
}

Validation

Objects with at_least_one constraints can be validated at runtime:

var actor = new Actor(); // no user, process, or app_name set
IReadOnlyList<string> errors = OcsfValidator.Validate(actor);
// errors[0]: "At least one of [process, user, ...] must be set on Actor."

Design

• All types are records with init properties — immutable by default, supports with expressions
• Concrete types are sealed; base/category types are abstract
• All properties are nullable — validation is a separate concern
• Targets netstandard2.0 for maximum compatibility (.NET Framework 4.6.1+, .NET Core 2.0+, .NET 5+)

Links

• OCSF Schema Browser
• OCSF GitHub
• Changelog