Get OCSF object
ocsf_get_objectRetrieve complete OCSF object definitions to understand nested structures, view fields and types, and map source data correctly for cybersecurity event analysis.
Instructions
Get the complete definition of an OCSF object type including all fields and metadata.
Use this tool to:
Understand complex nested object structures in OCSF classes
See the fields and types within objects like 'file', 'process', 'user'
Map source data to nested OCSF structures correctly
Reference when constructing TQL operators for OCSF mapping
Objects are reusable components within OCSF event classes, defining standard structures like endpoints, files, processes, etc.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| version | Yes | OCSF schema version (e.g., '1.3.0') | |
| name | Yes | OCSF object name (e.g., 'email', 'file', 'process') |