What are the best practices for normalizing IDS alerts in OCSF?

[hatscode]

I’m integrating snort IDS alerts into an OCSF pipeline.

Which category or class should IDS alerts use?

How should I handle custom fields not in OCSF?

Any tips for severity mapping?

Looking for best practices from others who’ve done this.

[mavam]

Check out this article: https://github.com/ocsf/ocsf-docs/blob/main/articles/modeling-alerts.md

In general, you want to think of an IDS alert as a Detection Finding and set the is_alert field to true.

If regular events can be escalated into alerts, use the Security Control profile.

A Detection Finding is more high-level and has "container semantics", e.g., consider putting your contributing events into finding_info.related_events.

[pagbabian-splunk]

I concur with that. As for what event class to use, likely one of the Network Activity classes, but applying the Security Control profile with is_alert = true as @mavam suggests here.