name: "Recorded Future ASI Issues → OCSF"
description: "Maps a Recorded Future ASI risk issue (project issues, results_path = data) to OCSF Detection Finding fields. Each issue is a triggered risk rule with example affected hosts."
field_mappings:
  title: "name"
  description: "description"
  # _severity is injected by the fetch script (high=5, moderate=3, informational=1).
  severity: "_severity"
# results_path = data; source_path is JSONata over ONE issue object.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "name",                          ocsf_field: "finding_info.uid" }
  - { source_path: "name",                          ocsf_field: "finding_info.title" }
  - { source_path: "description",                   ocsf_field: "finding_info.desc" }
  - { source_path: "classification",                ocsf_field: "activity_name" }
  - { source_path: "rule_metadata.references[0]",   ocsf_field: "finding_info.src_url" }
  # ── Example affected host ─────────────────────────────────────────
  - { source_path: "example_entities.domains[0].example", ocsf_field: "src_endpoint.hostname" }
  - { source_path: "example_entities.ips[0].example",     ocsf_field: "src_endpoint.ip" }
