The Cost of a Correct Triage

Other vendors also normalize to OCSF - but normalization that relies on AI agents/co-pilots introduces fragility because of the non-deterministic nature of AI. Axoflow normalizes autonomously and deterministically: the same security-semantic field mapping, every source, every run, without manual intervention. That determinism is what makes the cost reduction shown here reproducible in production, not just in a benchmark.

Results at a Glance

One alert, 82 correlated logs, Claude Opus 4.8, agentic loop. Each tier in its best correct-capable configuration, 3 runs each, graded against ground truth:

And the finding that frames everything - raw without enrichment cannot be made correct at any price:

Raw failed every no-enrichment run on false positives - flagging benign IPs as hostile - because raw logs carry no geo/intel/asset fields to separate the RU known-scanner from benign US traffic. OCSF carries them inline; raw must fetch them, and only then gets it right.

‍

Boundary Conditions

How the Alert Is Handled with Raw Logs

A detection engineer drops the correlated logs into a file and points the agent at it. From the actual run transcripts, raw triage proceeds:

1. Write to file, then "parse and triage raw.log."
2. Discover the formats - the agent runs head samples and finds four different formats mixed together.
3. Try jq - works on the CloudTrail/EDR JSON, dies on the ASA syslog and the tab-delimited Windows 4625.
4. Hand-roll a parser per non-JSON format - switch to sed/awk/regex, write a pattern, get a partial match, re-read the fat raw line to fix field offsets, wrestle the priority header and duplicated ip/port (ip/port) tuples, retry. This dominated the loop (raw baseline ran 14-32 turns).
5. Dedup, correlate across formats, render a verdict.

Raw vs OCSF (curated) vs OCSF (pruned) - the Workflows

The two reduction tiers attack different things: OCSF normalization removes the parser-crafting and supplies the enrichment inline; field-pruning further shrinks the payload per record. Both shorten the loop - but pruning has a floor.

‍

Token & Cost Per Tier

Full investigation, default settings (4 runs/tier, mean)

Raw to OCSF at default settings: 45% fewer tokens, s 31% cheaper. Real, but modest - and erodable by a good prompt.

The metric that counts - cost to a correct triage (3 runs/tier, graded)

• OCSF is 23% cheaper than raw per correct triage; pruned 54% cheaper - but pruned hit a fidelity floor: 1 of 3 runs missed the multi-stage chain. It produced no false positives, but under-called the attack.
• Raw's premium is the price of re-acquiring enrichment. Raw went 0/9 to 3/3 only once given a threat-intel lookup; it then costs 23-54% more than OCSF.

‍

Where Did the Tokens Go?

Across every tier, the cost is re-reading the accumulating transcript each turn, not the logs themselves:

87-93% of all tokens are cache re-reads. Because this re-read cost grows with the number of turns, anything that shortens the loop attacks the dominant term directly. In the best-correct configs, fewer turns drop the read share to 78-83% and the totals to 135-248K.

‍

Possible Cost Levers

Measured token reduction vs the default baseline (factorial across tiers):

The single biggest token reducer is the system prompt (-69%) - but it is correctness-blind. The same prompt that makes raw cheap makes it wrong: it dispositions fast on data it can't disambiguate, and over-flags.