OCSF Detection Finding sink output

[mostafa]

Summary

Add a per-sink format: ocsf option that serializes detections, correlations, incidents, and risk incidents to OCSF class 2004 (Detection Finding) JSON so findings flow natively into consumers that expect OCSF.

Motivation

Major platforms standardized on OCSF findings. rsigma already documents OCSF as an enricher render convention; promoting it to a first-class serializer removes ETL glue for common destinations.

Proposed approach

• Thread a sink-format seam through line sinks (stdout, file, NATS, unix) via ?format=ocsf.
• Serializer module mapping rule metadata, ATT&CK tags, risk objects, severity, and incident state; unmappable fields under unmapped.
• Pin OCSF 1.1.0 in metadata; golden wire tests and schema fixture validation.
• Docs guide for OCSF findings and output reference updates.

Out of scope

• Parquet / Security Lake packaging in v1.
• OCSF as an input vocabulary or OTLP/webhook mapping.
• Batch-command emission in v1.

Tasks

• Behavior-neutral sink-format seam
• OCSF serializer and ?format=ocsf parsing
• Goldens and schema conformance tests
• Docs and CHANGELOG

References

• Delivery layer and sink specs in rsigma-runtime
• Unified result types and incident/risk envelopes
• Existing OCSF enricher convention docs