Skip to content
Alchemy Logo

OCSF Mapping

Suggested mapping from Alchemy activity actions to OCSF event classes.

When you stream Activity Log events to a SIEM via webhook subscriptions, each event carries an action field (e.g. APP_APP_CREATED). Many SIEMs normalize events into the Open Cybersecurity Schema Framework (OCSF). This page provides a suggested mapping from each Alchemy action value to an OCSF event class, plus the complete list of actions Alchemy emits.

This is a suggested reference mapping, not a contract. OCSF classes evolve and your detection model may differ, so adapt the mapping to your environment. Alchemy delivers its own payload shape (see Webhook Subscriptions → Payload); the mapping is applied in your SIEM's ingest pipeline.

  1. Read the action field from each webhook event.
  2. Look it up in the tables below to find the suggested OCSF class and class_uid.
  3. In your SIEM ingest pipeline, set the OCSF class_uid (and a sensible activity_id) accordingly, and map the Alchemy fields onto OCSF attributes, for example:
Alchemy fieldOCSF attribute
timestamptime
actor.id / actor.display_nameactor.user.uid / actor.user.name
source_ipsrc_endpoint.ip
messagemessage
actionmetadata.product.feature.name (or a custom field)
request_idmetadata.correlation_uid

OCSF classclass_uid
Authentication3002
Account Change3001
User Access Management3005
Entity Management3004
API Activity6003

actionDescription
AUTH_LOGIN_SUCCESSLogin success
AUTH_LOGIN_FAILEDLogin failed

actionDescription
AUTH_PASSWORD_RESET_REQUESTEDPassword reset requested
AUTH_PASSWORD_RESET_COMPLETEDPassword reset completed
ACCOUNT_TEAM_NAME_UPDATEDTeam name updated
ACCOUNT_TEAM_USER_INVITE_SENTUser invited to team
ACCOUNT_TEAM_USER_INVITE_ACCEPTEDUser accepted team invite
ACCOUNT_TEAM_USER_REMOVEDUser removed from team
ACCOUNT_TEAM_USER_DETAILS_UPDATEDUser details updated
ACCOUNT_TEAM_USER_ADDEDUser invited to team (legacy)
ACCOUNT_TEAM_ONBOARDING_NETWORK_UPDATEDOnboarding network updated

actionDescription
ACCOUNT_TEAM_USER_ROLE_UPDATEDUser role updated

actionDescription
APP_APP_CREATEDApp created
APP_APP_DELETEDApp deleted
APP_APP_NAME_UPDATEDApp name updated
APP_APP_DESCRIPTION_UPDATEDApp description updated
APP_APP_KEY_ROTATEDAPI key rotated
APP_API_KEY_ACCESS_UPDATEDAPI key access updated
APP_JWT_CREATEDJWT created
APP_JWT_DELETEDJWT deleted
ACCOUNT_ACCESS_KEY_CREATEDAccess key created
ACCOUNT_ACCESS_KEY_DELETEDAccess key deleted
APP_ALERT_CREATEDAlert created
APP_ALERT_UPDATEDAlert updated
APP_ALERT_DELETEDAlert deleted
APP_ALERT_ENABLEDAlert enabled
APP_ALERT_DISABLEDAlert disabled
APP_INITIALIZE_GAS_POLICYGas policy initialized
APP_INITIALIZE_WALLET_CONFIGWallet config initialized
APP_GAS_POLICY_CREATEDGas policy created
APP_GAS_POLICY_UPDATEDGas policy updated
APP_GAS_POLICY_DELETEDGas policy deleted
APP_GAS_POLICY_ACTIVATEDGas policy activated
APP_GAS_POLICY_DEACTIVATEDGas policy deactivated
APP_GAS_PUMP_PROGRAM_CREATEDGas program created
APP_GAS_PUMP_PROGRAM_UPDATEDGas program updated
APP_GAS_PUMP_PROGRAM_DELETEDGas program deleted
APP_GAS_PUMP_PROGRAM_BUILDER_APPROVEDGas program builder approved
APP_GAS_PUMP_PROGRAM_BUILDER_REJECTEDGas program builder rejected
WALLET_KEY_QUORUM_CREATEDWallet key quorum created
WALLET_KEY_QUORUM_UPDATEDWallet key quorum updated
WALLET_KEY_QUORUM_DELETEDWallet key quorum deleted

These are security-relevant configuration changes. Some teams prefer to route them to a dedicated "configuration change" detection pipeline.

actionDescription
APP_NETWORK_ENABLEDNetwork enabled
APP_NETWORK_DISABLEDNetwork disabled
APP_NETWORK_ALL_ENABLEDAll networks enabled
APP_NETWORK_ALL_DISABLEDAll networks disabled
APP_ALLOWLIST_RESTRICTED_ADDRESS_ADDEDAllowlist restricted address added
APP_ALLOWLIST_RESTRICTED_ADDRESS_REMOVEDAllowlist restricted address removed
APP_ALLOWLIST_RESTRICTED_DOMAIN_ADDEDAllowlist restricted domain added
APP_ALLOWLIST_RESTRICTED_DOMAIN_REMOVEDAllowlist restricted domain removed
APP_ALLOWLIST_RESTRICTED_IP_ADDEDAllowlist restricted IP added
APP_ALLOWLIST_RESTRICTED_IP_REMOVEDAllowlist restricted IP removed
ACCOUNT_TEAM_IP_ALLOWLIST_IP_ADDEDIP allowlist address added
ACCOUNT_TEAM_IP_ALLOWLIST_IP_REMOVEDIP allowlist address removed
ACCOUNT_TEAM_IP_ALLOWLIST_IP_UPDATEDIP allowlist address updated

actionDescription
BILLING_PLAN_UPDATEDBilling plan updated
BILLING_PLAN_SPEND_LIMIT_UPDATEDSpend limit updated
BILLING_USAGE_LIMIT_UPDATEDUsage limit updated
BILLING_USAGE_LIMIT_BY_APP_UPDATEDApp usage limit updated
BILLING_PAYMENT_METHOD_ADDEDPayment method added
BILLING_PAYMENT_METHOD_REMOVEDPayment method removed
BILLING_PAYMENT_METHOD_UPDATEDPayment method updated (legacy)
BILLING_INVOICE_EMAIL_ADDEDInvoice email added
BILLING_INVOICE_EMAIL_REMOVEDInvoice email removed
BILLING_INVOICE_EMAIL_UPDATEDInvoice email updated (legacy)
BILLING_PAYMENT_ADDRESS_UPDATEDPayment address updated
BILLING_TAX_DETAILS_UPDATEDTax details updated
BILLING_APP_USAGE_CAP_CREATEDUsage cap created
BILLING_APP_USAGE_CAP_UPDATEDUsage cap updated
BILLING_APP_USAGE_CAP_DELETEDUsage cap deleted
BILLING_USAGE_AUTOSCALE_ENABLEDAutoscale enabled
BILLING_USAGE_AUTOSCALE_DISABLEDAutoscale disabled
ACCOUNT_ACTIVITY_LOG_EXPORTEDActivity log exported
ACCOUNT_ACTIVITY_LOG_WEBHOOK_SUBSCRIPTION_CREATEDWebhook subscription created
ACCOUNT_ACTIVITY_LOG_WEBHOOK_SUBSCRIPTION_UPDATEDWebhook subscription updated
ACCOUNT_ACTIVITY_LOG_WEBHOOK_SUBSCRIPTION_DELETEDWebhook subscription deleted

Smart-wallet events are product-specific. Map session lifecycle to Authentication (3002) and signing/sync activity to API Activity (6003), or to a custom class that fits your detection model.

actionDescriptionSuggested class
WALLET_SESSION_CREATEDWallet session createdAuthentication (3002)
WALLET_SESSION_DISCONNECTEDWallet session disconnectedAuthentication (3002)
WALLET_SESSION_APPROVEDWallet session approvedAuthentication (3002)
WALLET_SESSION_DENIEDWallet session deniedAuthentication (3002)
WALLET_SESSION_REVOKEDWallet session revokedAuthentication (3002)
WALLET_SIGNATURE_REQUESTEDWallet signature requestedAPI Activity (6003)
WALLET_SIGNATURE_COMPLETEDWallet signature completedAPI Activity (6003)
WALLET_SIGNATURE_REJECTEDWallet signature rejectedAPI Activity (6003)
WALLET_SYNCEDWallet syncedAPI Activity (6003)

  • New action values may be added over time. Handle unknown actions gracefully in your pipeline (e.g. fall back to a generic OCSF class such as API Activity (6003)) rather than dropping the event.
  • Actions marked (legacy) are retained for backward compatibility and may appear in historical data.
Was this page helpful?