OTRF/OSSEM resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1300 stars · 209 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

OSSEM is a community-led project that documents, standardizes, and models security event logs through data dictionaries, a common data model, and a detection model. It provides structured metadata about security event logs from Windows, Linux, macOS, Azure, AWS, and other sources to support log parsing and detection engineering.

Use cases

• standardize security event log field names across data sources
• normalize security logs into a common data model for SIEM pipelines
• look up field definitions for Windows, Linux, macOS, Azure, or AWS event logs
• map relationships among security events to build threat detection analytics
• validate detection coverage of adversary techniques against event data
• build a data wiki documenting security event logs in an organization

When to choose

• you are a detection engineer or threat hunter needing standardized log schemas
• you want to normalize heterogeneous security event logs into a common schema
• you need reference documentation for security event log fields and providers
• you are developing analytics and want event relationship models to guide detections

When to avoid

• you need a tool that actively parses or ingests logs rather than schema documentation
• you require a maintained product with frequent releases (latest release was early 2023)
• you need vendor-specific log formats not covered by the community dictionaries

Facets

dataset · maturity maintenance

documentation security parser data-science security documentation developer-tools cross-platform python security-event-logs data-dictionaries common-data-model detection-model siem threat-detection log-normalization metadata

Member repositories

For agents

markdown · JSON · MCP: product_card(name="OTRF/OSSEM")