REDUCING THE NOISE: HOW ATLASSIAN BUILT AN OCSF SECURITY LAKEHOUSE ON DATABRICKS

Summary from the TLDR InfoSec newsletter

Atlassian normalized 44 billion daily security events to OCSF by embedding the full schema in Go structs, so every log was validated at compile time, and its agentic mapping workflow could not emit invalid fields. That rigid typing enabled SOC analysts to self-serve log onboarding through a canary-gated pipeline, mapping two-thirds of the data in two months after the first third had taken a year. Standardized entity values like actor.user then enabled the detection team to replace one-to-one alerts with clustered, risk-based signals across 500+ detections.