Merge pull request #61 from natesmalley/transform-ocsf-backfill

pipelines: backfill ingest_mode and auth_type on transform_ocsf/

Author: nate-smalls-s1

pipelines/community/transform_ocsf/agent_metrics_logs/metadata.yaml

@@ -13,6 +13,8 @@ metadata_details:
   format: json
   ocsf_version: 1.3.0
   ingestion_method: "Observo OCSFSerializer (Lua-based transform)"
+  ingest_mode: "Other - {Explain: SentinelOne agent self-reported telemetry}"
+  auth_type: "N/A"
   ocsf_mapping:
     class_uid: 5001
     class_name: "Device Inventory Info"

pipelines/community/transform_ocsf/akamai_cdn/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Syslog"
+  auth_type: "N/A"
   sample_record: "{\n  \"raw\": \"2026-04-20T02:26:52Z AkamaiCDN streamId=\\\"stream-735\\\" cp=\\\"87876\\\
     \" reqId=\\\"tsuzt53unx\\\" statusCode=304 cliIP=\\\"176.105.197.188\\\" reqHost=\\\"img.example.com\\\
     \" reqMethod=\\\"GET\\\" reqPath=\\\"/js/app.js\\\" bytes=525284 cacheStatus=\\\"TCP_MISS\\\" turnAroundTimeMSec=331\

pipelines/community/transform_ocsf/akamai_dns/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Syslog"
+  auth_type: "N/A"
   sample_record: "{\n  \"raw\": \"2026-04-19T19:07:52Z AkamaiDNS streamId=\\\"dns-662\\\" cliIP=\\\"4.61.218.110\\\
     \" resolverIP=\\\"8.8.8.8\\\" domain=\\\"app.example.net\\\" recordType=\\\"AAAA\\\" responseCode=\\\
     \"REFUSED\\\" answer=\\\"\\\" edge=\\\"edge-nyc\\\" ttl=0 bytes=64\"\n}"

pipelines/community/transform_ocsf/akamai_general/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Syslog"
+  auth_type: "N/A"
   sample_record: "{\n  \"raw\": \"2026-04-19T09:18:52Z AkamaiSecurity clientIP=\\\"144.165.201.238\\\"\
     \ host=\\\"blog.example.com\\\" path=\\\"/login\\\" ruleId=\\\"925798\\\" attackType=\\\"Command_Injection\\\
     \" action=\\\"rate_limited\\\" httpMethod=\\\"HEAD\\\" status=400 userAgent=\\\"Googlebot/2.1\\\"\

pipelines/community/transform_ocsf/akamai_sitedefender/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Syslog"
+  auth_type: "N/A"
   sample_record: "{\n  \"type\": \"akamai_siem\",\n  \"attackData\": {\n    \"clientIP\": \"198.51.100.2\"\
     ,\n    \"configId\": \"20933\",\n    \"policyId\": \"p_10245\",\n    \"rules\": []\n  },\n  \"httpMessage\"\
     : {\n    \"method\": \"DELETE\",\n    \"host\": \"api.example.com\",\n    \"path\": \"/search\",\n\

pipelines/community/transform_ocsf/apache_http_logs/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: file-based agent ingestion (Apache access/error log)}"
+  auth_type: "N/A"
   sample_record: "{\n  \"raw\": \"10.29.72.231 - - [20/Apr/2026:03:40:52 +0000] \\\"HEAD /settings HTTP/1.1\\\
     \" 200 5305\"\n}"
   dependency_summary: Requires Observo OCSFSerializer template with Lua runtime (lupa). Source events

pipelines/community/transform_ocsf/aws_cloudtrail/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: object store (S3) with SQS/SNS notifications}"
+  auth_type: "IAM Role"
   sample_record: "{\n  \"eventCategory\": \"Management\",\n  \"eventName\": \"CreateUser\",\n  \"eventSource\"\
     : \"iam.amazonaws.com\",\n  \"eventTime\": \"2026-04-20T03:40:52Z\",\n  \"eventVersion\": \"1.09\"\
     ,\n  \"eventID\": \"4ad68099-cad0-4172-8711-dd15c4d352c9\",\n  \"eventType\": \"AwsApiCall\",\n  \"\

pipelines/community/transform_ocsf/aws_elasticloadbalancer_logs/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: object store (S3) for ELB access logs}"
+  auth_type: "IAM Role"
   sample_record: "{\n  \"type\": \"https\",\n  \"time\": \"2026-04-20T03:40:52.700664Z\",\n  \"alb\":\
     \ \"corporate-alb-3\",\n  \"client_ip\": \"192.168.10.200\",\n  \"client_port\": 41655,\n  \"backend_ip\"\
     : \"172.16.1.50\",\n  \"backend_port\": 443,\n  \"request_processing_time\": 0.029082,\n  \"backend_processing_time\"\

pipelines/community/transform_ocsf/aws_guardduty/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: AWS EventBridge or S3 export of GuardDuty findings}"
+  auth_type: "IAM Role"
   sample_record: "{\n  \"schemaVersion\": \"2.0\",\n  \"accountId\": \"222708836859\",\n  \"region\":\
     \ \"us-east-1\",\n  \"partition\": \"aws\",\n  \"id\": \"8db850b8-f1b1-4dfd-8676-efd7b4e8ee85\",\n\
     \  \"arn\": \"arn:aws:guardduty:us-east-1::84378c5c8013403891eb51ada1b2a47b:detector/84378c5c8013403891eb51ada1b2a47b/finding/8db850b8-f1b1-4dfd-8676-efd7b4e8ee85\"\

pipelines/community/transform_ocsf/aws_guardduty_logs/metadata.yaml

@@ -14,6 +14,8 @@ metadata_details:
   format: source-specific JSON/KV/syslog
   ocsf_version: 1.3.0
   ingestion_method: Observo OCSFSerializer (Lua-based transform)
+  ingest_mode: "Other - {Explain: AWS EventBridge or S3 export of GuardDuty findings}"
+  auth_type: "IAM Role"
   sample_record: "{\n  \"schemaVersion\": \"2.0\",\n  \"accountId\": \"200759122295\",\n  \"region\":\
     \ \"ap-south-1\",\n  \"partition\": \"aws\",\n  \"id\": \"eb19bf82-4550-40d2-a0b8-ae97533cc0f2\",\n\
     \  \"arn\": \"arn:aws:guardduty:ap-south-1::e5485011576b45629ceb37d38e001440:detector/e5485011576b45629ceb37d38e001440/finding/eb19bf82-4550-40d2-a0b8-ae97533cc0f2\"\