Guidelines Needed: Mapping OCSF Datatypes to Different Database Systems

[DannyMor]

Hi OCSF'ers!

We are currently engaged in a project centred on mapping data to OCSF event classes using Snowflake. Our main focus is determining the best approach to effectively encode OCSF datatypes to other systems.

We are particularly interested in understanding whether any predefined conventions or standard encoders exist that could help guide our translation of datatypes. Furthermore, we're considering creating our own encoder to map our datetime_t OCSF datatype to timestamp_ltz in Snowflake, and are curious about the implications this could have for external customers mapping to OCSF.

Moreover, in instances where an equivalent datatype doesn't exist, should our fallback be the base type? A pertinent example of this would be the OCSF datatype email_t which doesn't have a Snowflake equivalent - would it be best to default to the base type, in this case a varchar string, for mapping purposes?

Any insights, past experiences, or information you can provide would be very much appreciated

[floydtree]

Hey thanks for reaching out, we have started a new workstream dedicated to solving topics such as the ones you have raised here. Take a look at https://github.com/ocsf/examples/tree/main/encodings repo, this should help you get an idea of the outcomes of that ongoing effort. Regarding your specific question, I would suggest joining our slack workspace and engaging in the #encodings channel.