Articles
From raw NetFlow to clean OCSF Network Activity
arrow_backTo the overview07 August 2026 | Tenzir GmbH
Network flow data gives security teams broad visibility without requiring them to retain packets. It is also awkward security data. NetFlow v5 uses a fixed record layout, while NetFlow v9 and IPFIX depend on exporter-specific templates. Vendors add their own information elements, and a field called source does not necessarily prove which endpoint initiated a connection.
A useful pipeline has to do more than turn bytes into fields. It has to keep exporter state, preserve vendor detail, and make semantic uncertainty explicit. It also needs to produce a stable event contract that downstream systems can use without knowing which flow protocol or exporter created the record.
This post follows that path: binary datagrams in, one OCSF Network Activity contract out.
This article is written by:
Tenzir GmbH
In a world where security data is often locked behind rigid platforms, soaring expenses, and proprietary formats, we believe in a different future, one where data flows freely, without constraints.
Security data should be a strategic asset, not a vendor-controlled burden. Every organization deserves powerful, intuitive tools that make security data accessible, illuminating, and actionable, without the headaches of complexity, silos, or unpredictable costs.
We exist to redefine how security teams process, analyze, and act on their data. Our approach is simple: build composable pipelines t