Send Auth Events to Your SIEM Without Custom ETL

Every IdP speaks a slightly different JSON. Teams then build ETL so Splunk, Elastic, or a security lake can search “login failed.” Those parsers break when a vendor adds a field.

Meanwhile MFA step-up and session revoke land minutes or hours late. Detection that needs those events is already behind.

The Open Cybersecurity Schema Framework (OCSF) gives authentication, account change, and access events a shared shape: actor, target, protocol, network, risk.

Write detections once. Point them at AuthOne, the firewall, and the cloud audit trail without a custom mapper per source.

Do not run a second agent farm just for auth logs. OpenTelemetry collectors already move traces and metrics. They can move identity events too, over OTLP, with backpressure you already understand.

SRE and SecOps share one reliability story instead of two competing log paths.

AuthOne can emit OCSF-shaped events on the request path — login, refresh, MFA, token issue — and export them with OpenTelemetry. No intermediate “normalize this dump” service.

That is what people mean by zero-ETL: the lake or SIEM ingests usable identity context immediately. Spend engineering time on hunts and response, not on yet another parser.