OCSF mapping in the Lakehouse Engine helps standardize fields across security data sources, so analysts spend less time translating field names and more time investigating.
Security data rarely arrives in a common language. One product may call a field src_ip; another may use a different name (source_ip, srcaddr, etc.) for the same concept. When analysts search across sources, they often have to remember those differences, maintain source-specific queries, or normalize data before it is ready for analysis.
Standard schema mapping in Cribl Search is designed to reduce that friction.
One schema, more consistent searches
With the new option, teams can map fields in Lakehouse engine data to the Open Cybersecurity Schema Framework (OCSF). Instead of working around each source’s field names, analysts can use more consistent OCSF field names across supported data types.
That consistency can make searches easier to write and adapt as teams investigate data from different vendor products. It also reduces the mental overhead of translating between namespaces—especially when an investigation spans multiple datasets.
Choose when to apply the mapping
Schema mapping is optional and configured through a dataset rule (GDI Step 3). Teams can choose whether to add mapped fields alongside the original fields or replace mapped source fields, depending on how they want the resulting data to appear in Search.
Mappings are associated with datatypes, helping Search apply the relevant field relationships to matching events. The initial implementation includes OCSF v1.8; future Search releases may include other standard schemas or versions.
Search also allows users to manually edit Schema Mappings by creating custom Datatypes, or cloning the built-in ones. This allows users the ability to extend the built-in functionality to any desired Schema Mappings both now and in the future.
Additionally, users can choose to either overwrite existing field names or add additional fields with Schema names. This gives users the option of maintaining the vendor-specific namespace in addition to the Schema namespace, versus only the Schema namespace.
OCSF mapping in action
Original source data
The source event before schema mapping.
2. Original dataset rule
The dataset rule before OCSF mapping is enabled.
3. Mapped dataset rule
The updated dataset rule with OCSF mapping enabled.
4. New data after mapping
The resulting event with mapped OCSF fields.
A practical step toward simpler investigations
Imagine an analyst investigating activity across several security datasets. Without a common schema, each source may require its own query logic and field-name checks. With OCSF mapping enabled for supported data, the analyst can work with more consistent field names across those sources—spending less time adapting the query and more time examining the activity.
Schema mapping does not change the value of understanding your data or validating the fields relevant to an investigation. It gives teams a more consistent starting point for searching across supported sources.
Make your data easier to work with
Every investigation depends on finding the right fields and connecting the right events. By making OCSF field names available in Cribl Search’s Lakehouse Engine, standard schema mapping helps teams reduce field-name translation and build searches that are easier to reuse across diverse security data.
