AlphaSOC

AlphaSOC Data Lake: Broader Coverage and Richer OCSF Output

Improvement

We have expanded what the data lake query API returns and what you can filter on, so more of your data is reachable and each record carries more detail.

Key features

  • Nothing is silently skipped: Events AlphaSOC does not yet map to a specific OCSF class are now returned as an OCSF Base Event with the original record attached, and can be queried with class_name=base_event. Coverage gaps are visible in your results instead of quietly missing from them.
  • More filters, in more places: evidence_type=system is now accepted in evidence queries, and user_agent filters match audit records as well as HTTP records.
  • Richer URL and endpoint detail: HTTP and evidence records now carry http_request.url.hostname, http_request.url.scheme, and http_request.url.path alongside the full URL, plus dst_endpoint.ip and dst_endpoint.port, so you can pivot on a hostname or a port without parsing strings yourself.
  • Activity rows are labeled distinctly: Results from the activity dataset now read "AlphaSOC Activity" rather than "AlphaSOC Evidence", so the two are easy to tell apart in Splunk and in raw API output.

All of these changes are additive, so existing queries and integrations continue to work unchanged.

Learn More