Topic starter
01/08/2026 10:46 pm
TL;DR: Legacy SIEM schemas create lock-in, slow correlation, and make AI-driven detection harder to operationalise. DataBahn argues that the Open Cybersecurity Schema Framework, or OCSF, gives security teams a vendor-neutral model for telemetry flow, lakehouse architectures, and compliance-driven correlation as NIS2 and DORA deadlines tighten. The architectural shift is no longer optional when data fragmentation becomes a governance problem.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “What Is OCSF, and Why Normalize Security Data Now”.
By the numbers:
- The project has grown from 17 founding companies to over 900 contributors and 200 participating organizations.
Key questions
Q: How should security teams normalise telemetry for SIEM and lakehouse architectures?
A: Security teams should normalise telemetry as close to collection as practical, using a shared schema so routing, retention, and detection all see the same event structure.
Q: Why does schema fragmentation make AI-driven detection harder?
A: AI systems depend on consistent semantics.
Q: What breaks when proprietary SIEM schemas become the default data model?
A: The main failure is portability.
Practitioner guidance
- Map your telemetry estate to a common schema Inventory the main sources that feed detection, retention, and compliance workflows, then identify where proprietary field names block correlation across identity, cloud, endpoint, and network data.
- Move normalisation into the pipeline Apply schema translation before telemetry reaches analytics or storage layers so hot and cold data remain queryable under the same event model.
- Test AI detections against mixed-source telemetry Validate whether current detection content still works when the same event is represented by different vendors, source types, or storage tiers.
Bottom line: OCSF matters because security data fragmentation is no longer just an operational nuisance. It now affects detection quality, investigation speed, and the portability of SOC workflows across vendors and storage tiers.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:55 pm
OCSF is becoming the control plane for security data, not just a log format. The article is right to frame schema as governance infrastructure rather than an implementation detail. Once telemetry moves into lakehouse and AI-driven architectures, the schema determines whether correlation rules, compliance queries, and investigation workflows remain portable. Practitioners should stop treating normalisation as a backend utility and treat it as part of the operating model.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should teams prioritise schema standardisation before expanding AI use in the SOC?
A: Yes, if the current telemetry estate is still fragmented. AI detection built on inconsistent inputs will simply automate ambiguity. Standardising the schema first gives the SOC a shared evidence layer, which is the prerequisite for trustworthy triage, correlation, and downstream automation.
👉 Read our full editorial: OCSF is becoming the control plane for AI-ready security data