Open Cybersecurity Schema Framework (OCSF) Firepower ASA log examples?

Bronette — Wed, 17 May 2023 15:04:25 GMT

I have some Cisco ASA and Firepower logs, and I am attempting to ingest these into the Amazon data lake. To ingest these logs into the Amazon Data lake they must be converted to the Open Cybersecurity Schema Framework (OCSF) format. There Great blog here on the Cisco and Amazon partnership with more background: https://blogs.cisco.com/security/cisco-joins-amazon-web-services-aws-for-the-launch-of-security-lake.

To ingest these into the Amazon data lake, they first must be converted into the OCSF log format which has definitions defined here: https://schema.ocsf.io/ . The OCSF log is a JSON based log and the organization has provided a sample log for an Amazon VPC Log. https://github.com/ocsf/examples/blob/main/Network%20Activity/Network%20Activity/AWS/VPC%20Flowlogs/vpcflowlog.json

The problem is I do not have any examples of a Firepower and ASA log converted into the OCSF format. Does anyone have any examples/field mappings/schemas of what a Cisco ASA/Firepower log would look like when converted into OCSF?

Re: Open Cybersecurity Schema Framework (OCSF) Firepower ASA log examp

bsaurusrex — Fri, 23 Feb 2024 02:40:15 GMT

Hello,

Did you ever come to any conclusion on this?

Re: Open Cybersecurity Schema Framework (OCSF) Firepower ASA log examp

lrypl — Thu, 25 Sep 2025 13:02:15 GMT

https://github.com/ocsf/examples/tree/main/mappings/markdown/Cisco/v1.3.0/ASA

topic Open Cybersecurity Schema Framework (OCSF) Firepower ASA log examples? in Network Security

Open Cybersecurity Schema Framework (OCSF) Firepower ASA log examples?

Re: Open Cybersecurity Schema Framework (OCSF) Firepower ASA log examp

Re: Open Cybersecurity Schema Framework (OCSF) Firepower ASA log examp