SOC Log Export (OCSF)¶
NetForge generates real Windows/Sysmon-style event XML during an episode. The SOC exporter re-maps that stream into OCSF-style JSON (Open Cybersecurity Schema Framework) records, so an episode can be:
- replayed into real SIEM / analytics tooling,
- used to evaluate a NetForge-trained defender against out-of-distribution log formats,
- shipped as a shareable, inspectable artifact of what the agents actually did.
It lives in netforge_rl.siem.export.
Capturing and exporting¶
Build the environment with record_siem=True to capture the full log stream (the live
observation buffer stays a rolling window; capture is separate), then export:
from netforge_rl.environment.parallel_env import NetForgeRLEnv
from netforge_rl.siem.export import export_ocsf
env = NetForgeRLEnv({'scenario_type': 'ransomware', 'max_ticks': 100, 'record_siem': True})
env.reset(seed=0)
# ... run an episode ...
n = export_ocsf(env, 'runs/episode.ocsf.jsonl') # returns number of events written
Each line is one OCSF-style record:
{
"metadata": {"product": {"name": "NetForge RL"}, "original_event_id": "3", "labels": []},
"class_uid": 4001,
"class_name": "Network Activity",
"activity_name": "Network Connection",
"time": 1,
"severity_id": 1,
"device": {"hostname": "10.0.1.206", "subnet": "10.0.1.0/24"},
"enrichments": {"SourceIp": "...", "DestinationPort": "445"},
"raw_event": "<Event>…</Event>"
}
Event mapping¶
| Source EventID | OCSF class | activity |
|---|---|---|
| 4624 / 4625 / 4648 / 4768 / 4776 | Authentication (3002) | logon / failure / kerberos / ntlm |
| 4688 / Sysmon 1 / Sysmon 10 | Process Activity (1007) | process creation / access |
| Sysmon 3 | Network Activity (4001) | network connection |
| Sysmon 22 | DNS Activity (4003) | DNS query |
Incident and honeytoken-trigger events are exported with an elevated severity_id. The raw
event string is preserved in raw_event, so no fidelity is lost in translation.
Per-record conversion¶
To convert a single log line (for streaming or custom pipelines):