We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for OCSF

Date	Changes
2025-11-25	Newly mapped key-value pairs from the `raw_data` raw log field. The potentially nested structure within `raw_data` is flattened into the additional.fields array. Each entry in this array has a key field, representing the concatenated path to the value within the original JSON structure (e.g., parentkey_childkey_grandchildkey). additional.fields: Newly mapped `raw_data` raw log field with `additional.fields` UDM field
2025-11-03	Added support for the event `Detection Finding` for some of the objects and its corresponding raw log fields into OCSF parser.
2025-09-05	Added support for the event `Detection Finding` and relevant corresponding raw log fields into OCSF parser.
2025-04-28	Handled the index overriding issue in the for loop.
2025-02-26	Added support for the categories of OCSF schema v1.1.0: System Activity (Process Activity), Findings (Security Finding), Identity and Access Management (Authentication, Authorized Session), Network Activity (Network Activity, HTTP Activity, DNS Activity, FTP Activity, Network File Activity), Application Activity (API Activity).
2025-01-30	Handled the error in the convert filter for the field `connection_info.direction_id`.
2023-10-30	Added support for additional two activity types.
2023-06-28	Promoted parser to default.