Normalization

OTel+ECS is dominating inside the application layer and cloud-native infrastructure. It is being driven by software developers and DevOps engineers pushing data up and out from their code.

OCSF is dominating inside the enterprise security data lake. It is being driven by security engineers pulling data in and down from third-party vendor appliances (like CrowdStrike, Okta, and Palo Alto Networks).