Mapping Schema to Programmatic Data Models?

[thelok]

Hello,

Looking for some guidance on how others are consuming (or producing) OCSF data. From my research it looks like many are using JSON parsers to map JSON strings into objects - but how are people mapping those JSON objects into programmatic data models so that they can be consumed in code in a friendly way (e.g. strong type checking)? For instance if one is working in python, C# or Java, what is the guidance on transforming the JSON data into models of that programming language? I can't find any public repositories that demonstrates consumption of OCSF data for programmatic use - is everyone just doing a free for all right now and writing proprietary mappings into their programming language of choice?

Thanks.

[zschmerber]

Welcome to the wild west of OCSF data transformation.

• Splunk has open sourced this tool for transforming and structuring of the data. https://github.com/ocsf/ocsf-java-tools
• I have been using https://www.benthos.dev to do the same. (example mapping: https://github.com/ocsf/examples/tree/main/mappings/bloblang)
• This Slack is where we often hangout to chat about mappings https://opencybersecu-lz97379.slack.com/archives/C05HLGHMKU2

[alanisaac]

I'll add that in the upper right of the schema server UI, JSON schema can be produced for all objects and classes:

There are implementations of generating code models from JSON schema in many languages, see https://json-schema.org/implementations#generators-from-schemas

I don't know if there are tools to generate those same exact JSON schemas outside of the OCSF server, but I could see there being a toolchain that combines those two concepts to automatically generate object models for OCSF in a variety of languages.

[thelok]

Great, this looks like a good place to start!