Generic SIEM / OCSF / CEF / OTLP Capture Guide For Unified aiFObserve

Best Capture Source

Use OTLP JSON that preserves the original security event in attributes or body. If your SIEM exports CEF, LEEF, OCSF, ECS, CIM, or a vendor schema, keep both the normalized fields and the raw vendor event.

Basic Logging

Capture these normalized fields:

Extended Logging

For full-scale analysis, keep:

• tenant/account/workspace/project/subscription ID
• cloud provider and region
• source and destination geo
• event category, class, type, and ID
• rule/signature ID, policy name, and attack category
• MITRE tactic and technique
• request method, response status, and user agent
• raw event body in event.original
• trace ID, span ID, request ID, or correlation ID

OCSF Notes

Keep class/category names, activity names, severity, disposition, actor/user, src_endpoint, dst_endpoint, http_request, cloud, and metadata fields.

CEF Notes

Keep CEF header values and extension fields such as:

• rt
• src, dst
• spt, dpt
• proto
• act
• request
• requestMethod
• cs*Label and cs*
• cn*Label and cn*
• suser, duser
• deviceVendor, deviceProduct

VALIDATION NOTE: spt/dpt (ports), act (action), request (host/URL), and suser/duser (identity) were confirmed missing from the converter's field-recognition tables when this guide was tested end-to-end with a realistic CEF payload — capturing exactly the fields above through an earlier converter build would have silently produced UserID falling back to source IP, and Host/URL/Action/port fields all empty, with no error raised. This has been fixed in the converter (these CEF abbreviations are now recognized directly), and re-confirmed with the same test payload. If you are running an older copy of otlp_to_aif_sessions.py, verify your converted output actually populates these fields rather than assuming the field list above is sufficient on its own.

OTLP Mapping Notes

Source: - https://opentelemetry.io/docs/specs/otel/logs/data-model/