// Do not edit directly!
// This file was generated by camel-quarkus-maven-plugin:update-extension-doc-page
[id="extensions-ocsf"]
= OCSF
:linkattrs:
:cq-artifact-id: camel-quarkus-ocsf
:cq-native-supported: true
:cq-status: Stable
:cq-status-deprecation: Stable
:cq-description: Marshal and unmarshal OCSF (Open Cybersecurity Schema Framework) security events to/from JSON
:cq-deprecated: false
:cq-jvm-since: 3.38.0
:cq-native-since: 3.38.0

ifeval::[{doc-show-badges} == true]
[.badges]
[.badge-key]##JVM since##[.badge-supported]##3.38.0## [.badge-key]##Native since##[.badge-supported]##3.38.0##
endif::[]

Marshal and unmarshal OCSF (Open Cybersecurity Schema Framework) security events to/from JSON

[id="extensions-ocsf-whats-inside"]
== What's inside

* xref:{cq-camel-components}:dataformats:ocsf-dataformat.adoc[OCSF data format]

Please refer to the above link for usage and configuration details.

[id="extensions-ocsf-maven-coordinates"]
== Maven coordinates

https://{link-quarkus-code-generator}/?extension-search=camel-quarkus-ocsf[Create a new project with this extension on {link-quarkus-code-generator}, window="_blank"]

Or add the coordinates to your existing project:

[source,xml]
----
<dependency>
    <groupId>org.apache.camel.quarkus</groupId>
    <artifactId>camel-quarkus-ocsf</artifactId>
</dependency>
----
ifeval::[{doc-show-user-guide-link} == true]
Check the xref:user-guide/index.adoc[User guide] for more information about writing Camel Quarkus applications.
endif::[]

[id="extensions-ocsf-usage"]
== Usage
The OCSF (Open Cybersecurity Schema Framework) extension provides support for marshalling and unmarshalling security events following the OCSF specification.

[id="extensions-ocsf-usage-basic-usage"]
== Basic Usage

[id="extensions-ocsf-usage-marshalling-ocsf-events"]
=== Marshalling OCSF Events

[source,java]
----
from("direct:start")
    .marshal().ocsf()
    .to("kafka:security-events");
----

[id="extensions-ocsf-usage-unmarshalling-ocsf-events"]
=== Unmarshalling OCSF Events

[source,java]
----
from("kafka:security-events")
    .unmarshal().ocsf()
    .to("direct:process");
----

[id="extensions-ocsf-usage-unmarshalling-to-a-specific-event-class"]
=== Unmarshalling to a Specific Event Class

[source,java]
----
from("kafka:security-events")
    .unmarshal().ocsf(DetectionFinding.class)
    .to("direct:process");
----

[id="extensions-ocsf-usage-supported-ocsf-event-classes"]
== Supported OCSF Event Classes

This extension includes support for 34 OCSF event classes including:

* *Findings*: `DetectionFinding`, `SecurityFinding`, `VulnerabilityFinding`, `ComplianceFinding`
* *System Activity*: `FileActivity`, `ProcessActivity`, `KernelActivity`, `MemoryActivity`
* *Network Activity*: `NetworkActivity`, `HttpActivity`, `DnsActivity`, `SshActivity`
* *IAM*: `Authentication`, `AuthorizeSession`, `AccountChange`, `GroupManagement`
* *Application Activity*: `ApiActivity`, `DatastoreActivity`, `WebResourcesActivity`

All event classes extend `OcsfEvent` which provides common attributes like `time`, `severity_id`, `class_uid`, and `metadata`.

[id="extensions-ocsf-usage-example-creating-a-detection-finding"]
== Example: Creating a Detection Finding

[source,java]
----
import org.apache.camel.dataformat.ocsf.model.DetectionFinding;
import org.apache.camel.dataformat.ocsf.model.FindingInfo;
import org.apache.camel.dataformat.ocsf.OcsfConstants;

DetectionFinding finding = new DetectionFinding();
finding.setActivityId(OcsfConstants.ACTIVITY_CREATE);
finding.setSeverityId(OcsfConstants.SEVERITY_HIGH);
finding.setTime(System.currentTimeMillis());
finding.setIsAlert(true);

FindingInfo info = new FindingInfo();
info.setTitle("Malware Detection");
info.setDesc("Potential malware detected on endpoint");
finding.setFindingInfo(info);

from("direct:start")
    .setBody(constant(finding))
    .marshal().ocsf()
    .to("splunk-hec:...");
----

[id="extensions-ocsf-usage-native-mode-support"]
== Native Mode Support

The OCSF extension fully supports native mode compilation. All OCSF model classes are automatically registered for reflection during the build process.

