Evidence search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
OCSF puts CloudTrail, Azure Activity Log and Google audit records into the same API Activity fields. Detections still depend on the mapping, the schema version and provider semantics that normalization does not erase.