Get OCSF object
ocsf_get_objectRetrieve the complete OCSF object definition, including all fields and metadata, to map source data to nested OCSF structures and reference TQL operators.
Instructions
Get the complete definition of an OCSF object type including all fields and metadata.
Use this tool to:
Understand complex nested object structures in OCSF classes
See the fields and types within objects like 'file', 'process', 'user'
Map source data to nested OCSF structures correctly
Reference when constructing TQL operators for OCSF mapping
Objects are reusable components within OCSF event classes, defining standard structures like endpoints, files, processes, etc.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | OCSF object name (e.g., 'email', 'file', 'process') | |
| version | Yes | OCSF schema version (e.g., '1.3.0') |