
Security analytics in Amazon OpenSearch Service now supports ingesting OCSF and custom log data, providing security detection rules and correlation capabilities to help reduce incident response time by analyzing connections between potential security incidents.


<div>
<p>This article discusses the new security analytics capabilities in Amazon OpenSearch Service, which now supports Open Cybersecurity Schema Framework (OCSF) formatted data and custom log types.</p>
<p>Specifically, the article covers:</p>
<ul>
<li>Native support for OCSF data ingested from Amazon Security Lake</li>
<li>Security detection rules for OCSF data</li>
<li>Ability to ingest and create custom detection rules for virtually any custom log type</li>
<li>Correlation engine to analyze and highlight connections between potential security incidents</li>
<li>Availability of these new capabilities in all AWS Regions where Amazon OpenSearch Service is available</li>
</ul>
</div>


Security analytics in OpenSearch Service now supports OCSF and custom logs

Related articles