I have some Cisco ASA and Firepower logs, and I am attempting to ingest these into the Amazon data lake. To ingest these logs into the Amazon Data lake they must be converted to the Open Cybersecurity Schema Framework (OCSF) format. There Great blog here on the Cisco and Amazon partnership with more background: https://blogs.cisco.com/security/cisco-joins-amazon-web-services-aws-for-the-launch-of-security-lake.
To ingest these into the Amazon data lake, they first must be converted into the OCSF log format which has definitions defined here: https://schema.ocsf.io/ . The OCSF log is a JSON based log and the organization has provided a sample log for an Amazon VPC Log. https://github.com/ocsf/examples/blob/main/Network%20Activity/Network%20Activity/AWS/VPC%20Flowlogs/vpcflowlog.json
The problem is I do not have any examples of a Firepower and ASA log converted into the OCSF format. Does anyone have any examples/field mappings/schemas of what a Cisco ASA/Firepower log would look like when converted into OCSF?
