Driving the adoption of CSNF – A common taxonomy for security event notifications
CSNF provides a framework for normalizing the multiplicity of security-related event notifications emitted by cloud service providers, SaaS applications and on-premise private cloud systems. The framework is based on a multicloud canonical data model for translating provider-specific observability messages into a common taxonomy. CSNF accelerates security operations workflows and enables security analysts to rapidly respond to complex, large-scale multicloud security threats.
The CSNF Project is focused on raising awareness and spurring industry adoption of CSNF for identifying and mitigating against multicloud security threats in the SOC. Team members are engaged with suppliers in the enterprise multicloud ecosystem to incorporate additional supplier-specific message mappings into CSNF.
In 2024, the project team will also be conducting “Capture the Flag” events at ONUG Spring and Fall so that SOC practitioners can gain direct, hands-on experience utilizing CSNF in a simulated environment where they are tasked with identifying multicloud security threats.
For SOC teams that use Splunk’s SIEM database, the CSNF multicloud canonical data model is available in Splunkbase as a Splunk Technology Add-On, so that incoming messages can be automatically mapped into their corresponding canonical representation
