Create an OCSF Mapping

Add OCSF mapping operators to a parser package. This workflow builds on a working parser package, adding a dispatcher and per-event-type mapping operators that transform cleaned events into OCSF-compliant output.

Workflow

Execute each step in order. Verify the Results before moving on.

1. Ensure a parser package exists

Before mapping to OCSF, you need a package that can parse and clean the source data. If one does not exist yet, complete the tenzir-create-parser-package workflow first.

Results:

• A working parser package with parse and clean operators