skills.rest
tenzir
tenzirOFFICIAL
Explore all skills by this author →
Website𝕏@tenzir_companyGitHub

create-ocsf-mapping

Generate OCSF mapping operators for Tenzir parser packages.

3|Updated Mar 5, 2026
Search Tags:#normalization#parser#mapping#ocsf#security data#tenzir
One-click install
npx skills add https://github.com/tenzir/skills --skill create-ocsf-mapping
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: create-ocsf-mapping
Source: https://github.com/tenzir/skills/tree/main/skills/create-ocsf-mapping
Command: npx skills add https://github.com/tenzir/skills --skill create-ocsf-mapping

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the creation of OCSF mapping operators, transforming raw log data into a standardized OCSF format for improved security data analysis and interoperability.

Core Features & Use Cases

  • OCSF Mapping Operator Generation: Creates dispatcher and per-event-type mapping operators.
  • Data Normalization: Transforms cleaned events into OCSF-compliant output.
  • Use Case: When you need to integrate diverse security logs into a central SIEM or data lake that uses the OCSF standard, this skill helps bridge the gap by creating the necessary TQL operators.

Quick Start

Use the create-ocsf-mapping skill to add OCSF mapping operators to the 'acme::product' parser package.

Frequently Asked Questions about create-ocsf-mapping

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I normalize raw security logs to the OCSF schema?▼

To normalize raw security logs to the OCSF schema, you must generate dispatcher and per-event-type mapping operators. This process transforms cleaned events into OCSF-compliant output for improved security data analysis.

What is the best way to map diverse security data to an OCSF-compliant SIEM?▼

Mapping diverse security data to an OCSF-compliant SIEM requires creating specific TQL mapping operators. These operators bridge the gap between raw parser packages and the standardized OCSF format for central interoperability.

Do I need existing parser packages to generate OCSF mapping operators?▼

Yes, existing parser packages are required to generate OCSF mapping operators. The skill creates dispatcher and per-event-type operators that build upon these parsers to produce OCSF-compliant output.

Can I use this approach to create mapping logic for any security data format?▼

You can create OCSF mapping logic for any security data format processed by existing Tenzir parser packages. It generates the necessary operators to normalize logs into OCSF-compliant output.

When do I need to generate OCSF mapping operators for security data?▼

You need to generate OCSF mapping operators when integrating diverse security logs into a central data lake or SIEM that requires OCSF compliance. This standardization ensures improved security data analysis and interoperability.

How does the dispatcher operator work in OCSF data normalization?▼

The dispatcher operator works in OCSF data normalization by routing cleaned events to specific per-event-type mapping operators. This architecture transforms raw logs into a standardized OCSF format.

Related Skills

Explore More Software Engineering Skills→
tenzirtenzir
3

create-parser-package

Scaffold Tenzir parser packages from sample log data.

Official
Intermediate
starlake-aistarlake-ai
209

ingest

Ingest data from diverse sources into a data lake or warehouse.

Official
Basic
tenzirtenzir
3

tenzir-docs

Query Tenzir documentation for TQL syntax, operators, and deployment configurations.

Official
Basic
zzoohubzzoohub

data-modeling

Transform business requirements into normalized data models for PostgreSQL or SQLite.

Community
Advanced