Issues

• metadata: for a SIEM that receives, processes, then stores an event, which time attribute holds each step?

  ocsf/ocsf-schema#1778 · Filter by author therajvira opened on Oct 12, 2026
  2

• Would file decomposition and/or specialisation be useful

  ocsf/ocsf-schema#1777 · Filter by author jedwardsol opened on Oct 7, 2026

• AI Training Security and Privacy Assurance Schema

  ocsf/ocsf-schema#1774 · Filter by author nikhilred2619 opened on Oct 4, 2026

• Extension proposal: accounting_decision object + normalized containment reason — the decision half of the evidence contract

  ocsf/ocsf-schema#1760 · Filter by author Levaj2000 opened on Sep 17, 2026
  2

• [Schema Enhancement] Add a constraint object: the terms of a delegation, and consumption against them

  ocsf/ocsf-schema#1756 · Filter by author Levaj2000 opened on Sep 10, 2026
  1

• Add is_final to the attestation object: producer-declared end of an append-only chain

  ocsf/ocsf-schema#1755 · Filter by author Levaj2000 opened on Sep 9, 2026
  1

• [RFC] A standalone class for agent-originated control-plane activity

  ocsf/ocsf-schema#1753 · Filter by author Levaj2000 opened on Sep 7, 2026

• endpoint.owner conflates accountable owner with last logged-in account

  system_activity
  ocsf/ocsf-schema#1752 · Filter by author r-bedekar opened on Sep 6, 2026
  3

• [Schema Enhancement] Make delegation lineage reconstructable from records: parent_uid requirement and a root identifier on delegation

  ocsf/ocsf-schema#1739 · Filter by author Levaj2000 opened on Aug 25, 2026

• [Schema Enhancement] Producer-recorded causal attribution: optional caused_by on base_event

  ocsf/ocsf-schema#1738 · Filter by author aryanval opened on Aug 24, 2026
  5

• [metaschema] Invalid attribute sibling property use is not detected

  ocsf/ocsf-schema#1737 · Filter by author rmouritzen-splunk opened on Aug 23, 2026

• Map Agent Harness Behavior to OCSF

  ocsf/ocsf-schema#1736 · Filter by author zedoraps opened on Aug 20, 2026
  6

• Proposal: Physical Security operational events (patrol, post staffing, alarm disposition, response, incident reporting)

  ocsf/ocsf-schema#1735 · Filter by author leeandrews9 opened on Aug 18, 2026
  3

• Distinguish ML-only vs rule/signature vs corroborated findings for remediation gating

  ocsf/ocsf-schema#1731 · Filter by author AAH20 opened on Aug 16, 2026

• [Schema Enhancement] Close the MCP tool-metadata gap: add an ai_tool object to the ai_operation profile

  ocsf/ocsf-schema#1728 · Filter by author Levaj2000 opened on Aug 13, 2026
  4

• Vendor-Agnostic Operational Categories, Classes, and Activities for OpenTelemetry-Based Observability Data

  ocsf/ocsf-schema#1727 · Filter by author send2stephy opened on Aug 13, 2026
  2

• Discovery: agent trust-base inventory, applying record_integrity per emission

  ocsf/ocsf-schema#1724 · Filter by author rabbidave opened on Aug 11, 2026
  3

• Per-node authority fields for the delegation object (follow-on to #1665)

  ocsf/ocsf-schema#1697 · Filter by author Levaj2000 opened on Jul 21, 2026

• Add a normalized stop_reason attribute for completion events

  ocsf/ocsf-schema#1696 · Filter by author Levaj2000 opened on Jul 21, 2026
  1

• Problem with the use of Application, Product and related attributes

  application_activitydiscoveryfindingsmaintainersv1.10.0
  ocsf/ocsf-schema#1695 · Filter by author pagbabian-splunk opened on Jul 17, 2026
  3

  

• Define timestamp_t semantically; make epoch milliseconds an encoding, not the type

  maintainers
  ocsf/ocsf-schema#1694 · Filter by author mavam opened on Jul 10, 2026
  10

• Microsoft Packaged App identification is needed in digital_signature object

  enhancementsystem_activity
  ocsf/ocsf-schema#1691 · Filter by author jedwardsol opened on Jul 9, 2026
  

• How do we capture information around the compliance interaction a given event may carry?

  ocsf/ocsf-schema#1685 · Filter by author hmadison opened on Jul 2, 2026
  1

• Detection Finding for Aggregate (Groups of Detections)

  findings
  ocsf/ocsf-schema#1679 · Filter by author cei1219 opened on Jun 25, 2026
  2

• Network Traffic 'bytes' - What does this include?

  network_activity
  ocsf/ocsf-schema#1678 · Filter by author cei1219 opened on Jun 25, 2026