OCSF is the emerging industry standard, backed by 18-plus organizations and used natively by Amazon Security Lake. It defines a common taxonomy for the most common event classes — authentication, network activity, endpoint behavior — stored as Parquet. Adopting OCSF at ingestion means detection rules and ML models remain portable across tools and vendors.