AlphaSOC now includes OCSF mappings for [system process events](https://schema.ocsf.io/1.5.0/classes/process_activity), with full support for array fields — enabling Sigma rules that target process data from platforms such as CrowdStrike and SentinelOne.

## [Learn More](/content/changelog/2026-05-15/ocsf-system-process-mappings/#learn-more/index.html)

- [OCSF Schema](https://schema.ocsf.io/)  
- [AlphaSOC: OCSF for Sigma](https://docs.alphasoc.com/detections_and_findings/sigma/alphasoc_extensions/custom_prefixes/ocsf/)