Proposal for initial support of AI systems

[irakledibm]

Summary

As artificial intelligence (AI) systems become increasingly integral to enterprise infrastructure, security teams require standardized, interoperable telemetry for detecting threats, ensuring compliance, and analyzing the behavior of complex AI workflows. This proposal introduces a structured extension of OCSF to support AI system observability and security telemetry through the addition of a new category, event classes, reusable objects, and specialized profiles.

Proposed Additions to OCSF

Category:

Category Name	UID	Description
AI System Activity	9	AI-specific events including inference operations, agent workflows, prompt security, and model telemetry.

Profiles:

Profile Name	Purpose
AI Inference	Adds latency, model info, token usage, and endpoints to inference events
AI Tool	Describes capabilities, constraints, compliance, and risk of tools

Events:

Class Name	Description
Model Inference Activity	Captures LLM/ML inference events with token usage and confidence data
AI System Activity	General telemetry about AI system operations
MCP Message Activity	Standardizes Model Context Protocol (MCP) communication logs
Agentic RAG Workflow Execution	Captures advanced RAG pipelines with stepwise traceability

Objects:

Object Name	Description
Workflow Step	Represents a single reasoning or tool step in an agentic workflow
Tool Call	Details arguments, results, and errors from tools invoked in MCP format
Tool	Object to represent metadata for AI tools used in agentic, communication or orchestration workflows.
Message Payload	Represents MCP message payload