Skip to content
Made in the UK

SIEM for MSPs

What is OCSF and why does it matter for MSP log normalisation?

By , CEO, CybaVerse. Last reviewed

OCSF, the Open Cybersecurity Schema Framework, is an open, vendor-neutral standard for describing security events in the same fields whatever tool produced them. For MSPs it matters because normalised data lets one detection rule, one search and one report work across every client, instead of rewriting them per vendor.

This page is part of our SIEM for MSPs guide.

What problem does log normalisation solve?

Every security tool names the same thing differently. One product calls it a user name, another an account, a third a principal. Without normalisation an MSP must write and maintain separate rules and searches for every vendor and every client. Normalisation maps them all to one shared set of fields first.

  • Rules written once apply to every tenant.
  • Analysts read the same fields whatever the source.
  • Swapping a client's EDR does not break detection.

What is OCSF in practice?

OCSF is an open-source schema project that defines event categories, classes and attributes for security data. It is published openly at schema.ocsf.io, so anyone can see how an authentication or process event should be described. It is not owned by a single SIEM vendor, which keeps data portable between tools and providers.

ApproachOwnerPortability
OCSFOpen community projectHigh, vendor-neutral
Vendor-specific schemaSingle SIEM vendorTied to that product
No normalisationNobodyRules rewritten per source

How do MSPs adopt normalisation, step by step?

Treat normalisation as part of onboarding, not an afterthought. The steps below keep data usable across clients and make sure nothing is silently lost when a source does not map cleanly. Review mapping quality whenever a client adds a new tool or a vendor changes its log format.

  1. Step 1: Inventory each client's sources

    List identity, endpoint, email, cloud and network sources, with the format each produces.

  2. Step 2: Map sources to OCSF classes

    Use a platform that maps common sources to OCSF automatically.

  3. Step 3: Keep unmapped fields

    Fields with no OCSF equivalent should be kept in an unmapped area, not dropped, so investigators can still see them.

  4. Step 4: Watch for normalisation failures

    Records that fail to map should be set aside for an engineer, not discarded.

Where does CybaOps fit with OCSF?

CybaOps normalises incoming security data to the open OCSF schema, so data from different tools and clients can be searched and investigated in the same way. The CybaVerse SOC investigates using the normalised data, and MSPs can search across their own clients' data too.

  • CybaOps normalises security data to the open OCSF schema.
  • CybaOps collects security logs from endpoints, firewalls, cloud and Microsoft 365 into one place.
  • Analysts and partners can search and investigate across their data in CybaOps, with AI help to build queries.
  • CybaOps works with the security tools you already have, including Microsoft Defender, Sophos and the other EDR tools you already use, so you do not have to rip and replace.
  • CybaOps connects to Microsoft Defender, Microsoft 365 and Entra ID logs.

OCSF

How OCSF turns many log formats into one schema

OCSF, the Open Cybersecurity Schema Framework, is an open, vendor-neutral standard for describing security events in the same fields whatever tool produced them.

01 Log sources

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

OCSF

02 The 4-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • SIEM in
  • CybaOne

What else do MSPs ask about OCSF?

Is OCSF the same as a SIEM?

No. OCSF is a schema, a way of describing data. A SIEM or MDR platform stores, searches and detects on that data.

Do I need to learn OCSF to use CybaOps?

No. Mapping happens in the platform. It helps to know the main event classes when searching.

Does normalisation lose detail?

It should not. Fields with no OCSF equivalent are kept rather than discarded.

What should you do next?

  1. List which clients already send logs anywhere, and who reads them today.
  2. Pick two clients to start with and agree what good looks like.
  3. Book a CybaOps demo to see the workflow on real data.

See CybaOps | Become a CybaVerse partner

See the workflow on real data.

Book a CybaOps demo