Object storage (S3 / OCSF)
Leak events are written into your data lake as files in OCSF 1.1 format.
How it works
Files are written as NDJSON foldered by date. The layout is the one Amazon Security Lake expects, so Athena and similar tools scan only the relevant days. Any S3-compatible store works.
The record format is an OCSF 1.1 Detection Finding. The store accepting the file does not mean your data lake processed the record; its ingestion cycle runs separately.
Severity mapping
| Dark Radar | OCSF severity_id |
|---|---|
| Critical | 5 |
| High | 4 |
| Medium | 3 |
| Low | 2 |
| Info | 1 |
Limits
Only objects are written; there is no reading, listing or deleting in the bucket.
Path escapes are not accepted in the folder prefix; nothing can be written outside the bucket.
The leaked value itself is not in the file.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.