Problem
OpenShell hardcodes OCSF_VERSION = "1.7.0" in crates/openshell-ocsf/src/lib.rs. The two largest OCSF consumers in the market expect earlier schema versions:
- AWS Security Lake: requires OCSF v1.1.0
- Splunk OCSF-CIM Add-On (splunkbase.splunk.com/app/6943): targets v1.1.0-v1.3.0
- CrowdStrike Falcon Next-Gen SIEM: ingests via Security Lake (v1.1.0)
OCSF v1.7.0 is not backward-compatible with v1.1.0 (field renames, new required fields, structural changes). Enterprise customers with existing OCSF-based security automation cannot use OpenShell events without building a custom transformation layer.
Context
When integrating OpenShell OCSF events with Splunk in a PoC, the Splunk OCSF-CIM Add-On could not map v1.7.0 events to CIM data models. Custom Splunk dashboards over raw JSON were needed as a workaround. The "drain to your existing SIEM" story breaks when the schema version doesn't match what the SIEM expects.
Proposed Solution
Add a gateway-level configuration option to control the OCSF schema version used for event emission:
[openshell.gateway]
ocsf_schema_version = "1.1" # or "1.3", "1.7" (default)
When set to an older version:
- Downgrade field names to match the target schema (e.g., renamed fields between versions)
- Omit fields that don't exist in the target version
- Set
metadata.version to the configured version
The default should remain the latest version (currently 1.7.0).
Alternatives Considered
- External transformation layer (Cribl, custom Lambda): Works but adds operational complexity and cost for every deployment. The transformation should happen at the source.
- Wait for SIEMs to catch up: Splunk and AWS move slowly on OCSF version adoption. v1.7.0 support may be months or years away.
- Emit both versions simultaneously: Doubles event volume. Not practical.
Impact
Enterprise deployments evaluating OpenShell for production need SIEM integration. The top 3 OCSF consumers all require v1.1.0. This blocks adoption unless operators build their own transformation pipelines.
Problem
OpenShell hardcodes
OCSF_VERSION = "1.7.0"incrates/openshell-ocsf/src/lib.rs. The two largest OCSF consumers in the market expect earlier schema versions:OCSF v1.7.0 is not backward-compatible with v1.1.0 (field renames, new required fields, structural changes). Enterprise customers with existing OCSF-based security automation cannot use OpenShell events without building a custom transformation layer.
Context
When integrating OpenShell OCSF events with Splunk in a PoC, the Splunk OCSF-CIM Add-On could not map v1.7.0 events to CIM data models. Custom Splunk dashboards over raw JSON were needed as a workaround. The "drain to your existing SIEM" story breaks when the schema version doesn't match what the SIEM expects.
Proposed Solution
Add a gateway-level configuration option to control the OCSF schema version used for event emission:
When set to an older version:
metadata.versionto the configured versionThe default should remain the latest version (currently 1.7.0).
Alternatives Considered
Impact
Enterprise deployments evaluating OpenShell for production need SIEM integration. The top 3 OCSF consumers all require v1.1.0. This blocks adoption unless operators build their own transformation pipelines.