CharlotteN7/dsh-ocsf-forwarder

README excerpt

dsh-ocsf-forwarder A read-side SIEM forwarder for DeepSeek Harness. It observes the session event firehose, normalises every event to OCSF 1.9.0 with the native ai operation profile, and writes newline-delimited OCSF JSON to a local append-only spool, optionally shipping it to Splunk HTTP Event Collector or an OTLP/HTTP collector. The complete event → OCSF mapping table for all 44 session event types is under Event mapping. ADR.md records the decisions that are not obvious from the code. What it does - Subscribes to session/event , session/created , and session/disposed , and sweeps ctx.sessions.list() at mount. - Correlates tool/call ↔ tool/result by callId and approval/asked ↔ approval/decided by ApprovalRequestId , emitting approval decision latency — the approval-fatigue signal. - Classifies tool calls by what they do: bash / pwsh / run code / cordis define / cordis run → Process Activity (1007), read / write / edit → File System Activity (1001), web fetch / web search → HTTP Activity (4002), approvals and sandbox/permission changes → Authorize Session (3003), everything else → API Activity (6003). - Names the MCP server behind every mcp call, so a SOC can pivot on which extern…

Category