OCSF

Overview

OCSF (Open Cybersecurity Schema Framework) integration for standardized security event ingestion.

Commands

Command	Description
`regscale ocsf convert`	Convert security data to OCSF format. NOTE: This is a placeholder command for future implementation. Full conversion requires understanding of source data schemas.
`regscale ocsf evidence-attach`	Attach OCSF log file as evidence to a RegScale Evidence record. This provides proof of log delivery and security event tracking for compliance purposes (FedRAMP, NIST, etc.).
`regscale ocsf ingest`	Ingest OCSF events from a file and create RegScale entities. Reads OCSF-formatted security events from JSON or JSONL files and creates: - RegScale Issues from compliance/vulnerability/detection findi
`regscale ocsf validate`	Validate OCSF events file without creating RegScale entities. Performs validation checks on OCSF-formatted events including: - JSON/JSONL syntax validation - Required OCSF base fields verification -

`regscale ocsf convert`

Convert security data to OCSF format.

NOTE: This is a placeholder command for future implementation. Full conversion requires understanding of source data schemas.

regscale ocsf convert [OPTIONS]

Flag	Type	Required	Default	Description
`--file, -f`	path	Yes	—	Path to source file to convert
`--source-format, -s`	choice	Yes	—	Source file format Choices: `json`, `csv`
`--output, -o`	path	Yes	—	Path to output OCSF-formatted file
`--output-format, -of`	choice	No	`json`	Output format (default: json) Choices: `json`, `jsonl`

`regscale ocsf evidence-attach`

Attach OCSF log file as evidence to a RegScale Evidence record.

This provides proof of log delivery and security event tracking for compliance purposes (FedRAMP, NIST, etc.).

regscale ocsf evidence-attach [OPTIONS]

Flag	Type	Required	Default	Description
`--log-file, -f`	path	Yes	—	Path to OCSF log file to attach as evidence
`--evidence-id, -e`	integer	Yes	—	RegScale Evidence ID to attach file to
`--title, -t`	text	No	`OCSF Security Events`	Title for the evidence attachment (default: 'OCSF Security Events')

`regscale ocsf ingest`

Ingest OCSF events from a file and create RegScale entities.

Reads OCSF-formatted security events from JSON or JSONL files and creates: - RegScale Issues from compliance/vulnerability/detection findings - RegScale Assets from affected resources

The command maps OCSF findings to Issues using: - affectedControls field for compliance control mappings - assetIdentifier field for affected resource identifiers

regscale ocsf ingest [OPTIONS]

Flag	Type	Required	Default	Description
`--file, -f`	path	Yes	—	Path to OCSF events file (JSON or JSONL format)
`--regscale_id, -id, --id`	integer	Yes	—	RegScale parent ID (typically SSP ID) to associate findings with
`--regscale_module, -m`	choice	No	`securityplans`	Enter the RegScale module name. RegScale Module Accepted Value Assessment \| assessments Asset \| assets Case \| cases Catalogue \| catalogues Causal Analysis \| causalanalysis Control Objective \| controlobjectives Component \| components Data Call \| datacalls Exception \| exceptions Incident \| incidents Interconnect \| interconnects Issue(POAM) \| issues Policy \| policies Project \| projects Questionnaire \| questionnaires Requirement \| requirements Risk \| risks Security Control \| securitycontrols Security Control Implementation \| controls Security Plan \| securityplans Security Profile \| profiles Supply Chain(Contract) \| supplychain Task \| tasks Threat \| threats Choices: `assessments`, `assets`, `cases`, `catalogues`, `causalanalysis`, `controlobjectives`, `components`, `datacalls`, `exceptions`, `incidents`, `interconnects`, `issues`, `policies`, `projects`, `questionnaires`, `requirements`, `risks`, `securitycontrols`, `controls`, `securityplans`, `profiles`, `supplychain`, `tasks`, `threats`
`--create-issues, --no-create-issues`	boolean	No	`true`	Create RegScale Issues from OCSF findings (default: enabled)
`--create-assets, --no-create-assets`	boolean	No	`true`	Create RegScale Assets from OCSF resources (default: enabled)
`--validate-schema, --no-validate-schema`	boolean	No	`true`	Validate events against OCSF schema (default: enabled)
`--schema-version, -v`	text	No	`1.6.0`	OCSF schema version to validate against (default: 1.6.0)

`regscale ocsf validate`

Validate OCSF events file without creating RegScale entities.

Performs validation checks on OCSF-formatted events including: - JSON/JSONL syntax validation - Required OCSF base fields verification - Event class identification - Resource and finding structure validation

regscale ocsf validate [OPTIONS]

Flag	Type	Required	Default	Description
`--file, -f`	path	Yes	—	Path to OCSF events file to validate
`--schema-version, -v`	text	No	`1.6.0`	OCSF schema version to validate against (default: 1.6.0)