Cloud Security Notification Framework
CSNF provides a standardized way for enterprise cloud consumers to receive security events, alarms, logs, etc., from all cloud providers. CSNF is implemented via a concept called a “decorator.” The decorator decorates security messages from AWS, GCP, Azure, IBM Cloud, and more and puts them into a common format.
This format has a range of attributions, two of which are to map security events to MITRE ATT&CK and NIST controls. This is how a common language is provided, and all providers will use standard meanings of terms. The decorator creates a common security information model, which has hugely positive implications for the industry