name: "Cortex XDR Incidents → OCSF"
description: "Maps a Cortex XDR incident (incidents/get_incidents/, results_path = reply.incidents) to OCSF finding fields. Incidents are aggregates; use get_incident_extra_data for per-alert detail."
field_mappings:
  title: "incident_name"
  severity: "severity = 'critical' ? 5 : (severity = 'high' ? 4 : (severity = 'medium' ? 3 : 2))"
  description: "description"
# results_path = reply.incidents; source_path is JSONata over ONE incident object.
# Paths absent from a given incident are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "incident_id",        ocsf_field: "finding_info.uid" }
  - { source_path: "incident_name",      ocsf_field: "finding_info.title" }
  - { source_path: "description",        ocsf_field: "finding_info.desc" }
  - { source_path: "creation_time",      ocsf_field: "finding_info.created_time" }
  - { source_path: "modification_time",  ocsf_field: "finding_info.modified_time" }
  - { source_path: "xdr_url",            ocsf_field: "finding_info.src_url" }
  - { source_path: "status",             ocsf_field: "status" }
  - { source_path: "alert_count",        ocsf_field: "count" }
  # ── MITRE ATT&CK (first aggregated tactic/technique) ──────────────
  - { source_path: "mitre_tactics_ids_and_names[0]",    ocsf_field: "attacks.tactic.name" }
  - { source_path: "mitre_techniques_ids_and_names[0]", ocsf_field: "attacks.technique.name" }
  # ── Affected host / user (hosts are 'hostname:agent_id' strings) ──
  - { source_path: "$split(hosts[0], ':')[0]", ocsf_field: "src_endpoint.hostname" }
  - { source_path: "users[0]",                 ocsf_field: "user.name" }
