f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(harfanglab): correct get_threats mapper to native threat fields; add agent.osversion

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-06-26 14:53:16 +02:00
parent 44694f6d9e
commit 0f4852bb54
3 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/harfanglab/mappers/get_security_events.yaml
+1
View File
@@ -12,6 +12,7 @@ ocsf:
- { source_path: "agent.domainname", ocsf_field: "src_endpoint.domain" }
- { source_path: "agent.osproducttype", ocsf_field: "src_endpoint.os.name" }
- { source_path: "agent.ostype", ocsf_field: "src_endpoint.os.type" }
- { source_path: "agent.osversion", ocsf_field: "device.os.version" }
- { source_path: "agent.agentid", ocsf_field: "device.uid" }
# ── Finding ───────────────────────────────────────────────────────
- { source_path: "id", ocsf_field: "finding_info.uid" }
integrations/harfanglab/mappers/get_threats.yaml
+7 -9
View File
@@ -1,5 +1,5 @@
name: "HarfangLab Threats → OCSF"
description: "Maps a HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results, enriched with agents/impacted_users/rules) to OCSF."
description: "Maps a raw HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results) to OCSF. Uses native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics); the agents/impacted_users/rules arrays only exist after XSOAR-side enrichment, which this connector does not perform."
field_mappings:
title: "slug"
severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
@@ -15,11 +15,9 @@ ocsf:
- { source_path: "last_seen", ocsf_field: "finding_info.last_seen_time" }
- { source_path: "last_update", ocsf_field: "finding_info.modified_time" }
- { source_path: "status", ocsf_field: "status" }
# ── Impacted endpoint (first enriched agent) ──────────────────────
- { source_path: "agents[0].hostname", ocsf_field: "src_endpoint.hostname" }
- { source_path: "agents[0].domainname", ocsf_field: "src_endpoint.domain" }
- { source_path: "agents[0].osproducttype", ocsf_field: "src_endpoint.os.name" }
- { source_path: "agents[0].ostype", ocsf_field: "src_endpoint.os.type" }
# ── Impacted user / rule ──────────────────────────────────────────
- { source_path: "impacted_users[0].full_name", ocsf_field: "user.name" }
- { source_path: "rules[0].rule_name", ocsf_field: "rule.name" }
# ── MITRE ATT&CK (native mitre_tactics list) ──────────────────────
- { source_path: "mitre_tactics[0]", ocsf_field: "attacks.tactic.name" }
# ── Top impacted endpoint / user / rule (native aggregates) ───────
- { source_path: "top_agents[0].agent_hostname", ocsf_field: "src_endpoint.hostname" }
- { source_path: "top_impacted_users[0].user_name", ocsf_field: "user.name" }
- { source_path: "top_rules[0].rule_name", ocsf_field: "rule.name" }