name: "Mock EDR Incidents → OCSF"
description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields. Events already arrive in an OCSF-aligned shape, so most paths map through directly."
field_mappings:
  title: "title"
  description: "description"
  source: "source"
  # toSeverity maps critical→5, high→3, medium→2, low→1, informational→1.
  severity: "severity"
# results_path = items; source_path is JSONata over ONE incident object.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "external_id", ocsf_field: "finding_info.uid" }
  - { source_path: "title",       ocsf_field: "finding_info.title" }
  - { source_path: "description", ocsf_field: "finding_info.desc" }
  - { source_path: "created_at",  ocsf_field: "finding_info.created_time" }
  - { source_path: "updated_at",  ocsf_field: "finding_info.modified_time" }
  - { source_path: "status",      ocsf_field: "status" }
  # ── Detection rule (analytic) ─────────────────────────────────────
  - { source_path: "rule.name",   ocsf_field: "finding_info.analytic.name" }
  - { source_path: "rule.uid",    ocsf_field: "finding_info.analytic.uid" }
  - { source_path: "rule.desc",   ocsf_field: "finding_info.analytic.desc" }
  # ── Affected host (source endpoint / device) ──────────────────────
  - { source_path: "src_endpoint.hostname", ocsf_field: "src_endpoint.hostname" }
  - { source_path: "src_endpoint.ip",       ocsf_field: "src_endpoint.ip" }
  - { source_path: "src_endpoint.os.name",  ocsf_field: "src_endpoint.os.name" }
  - { source_path: "src_endpoint.os.type",  ocsf_field: "src_endpoint.os.type" }
  - { source_path: "src_endpoint.hostname", ocsf_field: "device.hostname" }
  - { source_path: "device.uid",            ocsf_field: "device.uid" }
  - { source_path: "device.type",           ocsf_field: "device.type" }
  - { source_path: "device.os.build",       ocsf_field: "device.os.build" }
  - { source_path: "src_endpoint.os.name",  ocsf_field: "device.os.name" }
  # ── Network (destination / connection / DNS) ──────────────────────
  - { source_path: "dst_endpoint.ip",          ocsf_field: "dst_endpoint.ip" }
  - { source_path: "dst_endpoint.port",        ocsf_field: "dst_endpoint.port" }
  - { source_path: "connection_info.direction", ocsf_field: "connection_info.direction" }
  - { source_path: "dns_query.hostname",       ocsf_field: "dns_query.hostname" }
  # ── User ──────────────────────────────────────────────────────────
  - { source_path: "user.name",   ocsf_field: "user.name" }
  - { source_path: "user.domain", ocsf_field: "user.domain" }
  - { source_path: "user.uid",    ocsf_field: "user.uid" }
  # ── File artefact ─────────────────────────────────────────────────
  - { source_path: "file_path",   ocsf_field: "file.path" }
  # ── Cloud / metadata ──────────────────────────────────────────────
  - { source_path: "cloud.account.uid",           ocsf_field: "cloud.account.uid" }
  - { source_path: "metadata.original_event_uid", ocsf_field: "metadata.uid" }
  - { source_path: "source",                      ocsf_field: "metadata.product.name" }
  - { source_path: "metadata.product.version",    ocsf_field: "metadata.product.version" }
