Generic SIEM OCSF CEF OTLP Capture Guide For Unified aiFObserve

Best Capture Source

Use OTLP JSON that preserves the original security event in attributes or body. If your SIEM exports CEF, LEEF, OCSF, ECS, CIM, or a vendor schema, keep both the normalized fields and the raw vendor event.

Basic Logging

• timestamp
• source IP and destination IP
• source port and destination port
• protocol
• action or outcome
• user
• host, URL, domain, SNI, or application
• request and response bytes
• rule name or alert name
• severity
• vendor and product

Extended Logging

• tenant/account/workspace/project/subscription ID
• cloud provider and region
• source and destination geo
• event category, class, type, and ID
• rule/signature ID, policy name, and attack category
• MITRE tactic and technique
• request method, response status, and user agent
• raw event body in event.original
• trace ID, span ID, request ID, or correlation ID

OCSF Notes

Keep class/category names, activity names, severity, disposition, actor/user, src_endpoint, dst_endpoint, http_request, cloud, and metadata fields.

CEF Notes

Keep CEF header values and extension fields such as:

• rt
• src, dst
• spt, dpt
• proto
• act
• request
• requestMethod
• cs*Label and cs*
• cn*Label and cn*
• suser, duser
• deviceVendor, deviceProduct

OTLP Mapping Notes

OpenTelemetry logs include top-level timestamp, severity, body, resource, and attributes. Put normalized fields in attributes and preserve original event text in the body or event.original.

Source

• OpenTelemetry Logs Data Model