Recently, I was given a task with no plug-and-play solution: collect logs from AWS Security Lake and send them to Microsoft Sentinel through Cribl Stream. Here is how I solved it.
The challenge
Stores data in OCSF (Open Cybersecurity Schema Framework).
No official Cribl pack existed to convert OCSF to CEF.
Expects CEF (Common Event Format).
The solution: five custom Cribl packs
I built five custom Cribl packs from scratch. Each one normalizes and routes the logs from one source:
AWS CloudTrail
Account and API activity across your AWS accounts.
Amazon Route 53
DNS query logs, useful for spotting suspicious domains.
VPC Flow Logs
Network traffic between and out of your VPCs.
AWS Security Hub
Security findings collected from across AWS services.
Palo Alto firewall
Firewall traffic and threat logs from the network edge.
Each pack converts the raw OCSF data into Sentinel-ready CEF and routes it to the right place. That gives the security team full log visibility across the cloud and security layers.
How it works
The work started with research: comparing the OCSF and CEF schemas field by field, so nothing important was lost. Then I built dynamic pipelines in Cribl using functions such as Regex Extract, Eval and Serialize to reshape each record into the format Sentinel expects.
The result
Logs parsed. All five sources now flow into Sentinel without gaps.
Fields mapped. Detection rules, workbooks and hunting queries work as expected.
Teams empowered. Analysts see cloud and firewall activity in one place, with insights they can act on.
It was an exciting technical journey, from studying schemas to building pipelines that just work.
Bridging OCSF and CEF?
If you are working on something similar, I would be happy to connect and help.