Trying to implement security at scale and cover all the different aspects of it more or less requires a bunch of different applications all of which are trying

Trying to implement security at scale and cover all the different aspects of it more or less requires a bunch of different applications all of which are trying to make sense of the same data. This OCSF framework is trying to set out some standards on how that interop should happen. Put another way they're trying move from having plain text logs in Apache format to something more structured and formal that is (hopefully) easier to work with. You might be thinking: "Well what could be easier and more open than plain text logs? Some grepping, some regex and we're golden." The issue comes in that every single app that consumes those logs does so in a slightly different way and there's no standard (yadda yadda XKCD n+1 standards) enforceable format for handling those.