4.1.4. Edge Service Integrations and OCSF
First Principle: Modern security operations require interoperability between AWS edge services and third-party security tools. OCSF (Open Cybersecurity Schema Framework) provides the common data format that enables this integration without custom parsing for every source-destination pair.
OCSF (Open Cybersecurity Schema Framework) — new in C03:
- Open-source standard for security event data created by AWS and partners
- Defines a common schema for events from any source (AWS, on-premises, third-party)
- Security Lake uses OCSF as its native format for log storage and querying
- Eliminates the need to build custom parsers for each log source
Third-Party WAF Rules:
- AWS WAF supports rules from AWS Marketplace sellers (Fortinet, F5, Imperva, etc.)
- Enable specialized protection: API security, advanced bot detection, industry-specific rules
- Managed by the vendor — automatically updated with new threat intelligence
- Deploy alongside AWS Managed Rules for defense-in-depth at the rule level
Edge Integration Patterns:
| Integration | Mechanism | Use Case |
|---|---|---|
| WAF → Security Lake | OCSF-normalized WAF logs | Centralized security analytics |
| WAF → Kinesis Firehose | Real-time log streaming | Custom analytics/SIEM ingestion |
| CloudFront → Lambda@Edge | Custom request processing | Header manipulation, authentication |
| Shield Advanced → SRT | DDoS response team access | Active DDoS mitigation |
| Third-party rules → WAF | Marketplace subscriptions | Specialized threat protection |
⚠️ Exam Trap: OCSF is the log normalization standard (used by Security Lake). ASFF is Security Hub's finding format. A question about normalizing logs from multiple sources for analytics points to OCSF/Security Lake, not ASFF/Security Hub.
Scenario: A multinational company needs to integrate WAF logs with their Palo Alto SIEM. Rather than building custom log parsers, they enable Security Lake with WAF as a source, which normalizes logs into OCSF format, and configure Palo Alto as a Security Lake subscriber.
Reflection Question: How does OCSF as an industry standard reduce vendor lock-in and simplify multi-cloud security operations?
