feat(cortex-xdr): ingest alerts, not only incidents (v1.3.0)
An XDR incident is an aggregate; the SOC works the detections under it. The alerts endpoint was already exposed as a read command, but nothing could feed an alert rule with it — no results path, no dedup key, no watermark, no mapper, no incident type. All five are here now, so an alert rule can be pointed at reply.alerts the same way it is pointed at reply.incidents. get_alerts pages past the API's 100-results-per-call ceiling: an alert feed carries far more than a hundred detections between two polls, and whatever a single page leaves behind is never fetched again, because the next run's watermark has already moved past it. On an incremental fetch it also sorts oldest first, so a window larger than the limit drops its most recent alerts — the only ones the next poll can still see — and says so via `truncated`. Two fixes to the incident side while in the same files: - The severity expression compared strings, which the mapping engine cannot do (it reads numeric comparisons only). Every test read as false, so every ingested incident silently took the alert rule's default severity. The bare field works: Riposte maps critical/high/medium/low onto 1-5 itself. - The incident mapper carried no `time`, so the detection anchor was missing and MTTD stayed empty for the whole feed. creation_time fills it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,76 @@
|
||||
name: "Cortex XDR Alerts → OCSF"
|
||||
description: "Maps a Cortex XDR alert (alerts/get_alerts_by_filter_data/, results_path = reply.alerts) to OCSF Detection Finding fields. Alerts are the per-detection layer under incidents: one incident aggregates many alerts, so a tenant ingesting both feeds will hold the same detection twice, once as an aggregate and once on its own."
|
||||
field_mappings:
|
||||
title: "name"
|
||||
description: "description"
|
||||
# The raw string is enough: Riposte reads critical/high/medium/low/informational
|
||||
# onto its 1-5 scale itself, and the mapping engine cannot compare strings.
|
||||
severity: "severity"
|
||||
# Which sensor fired: "XDR Agent", "PAN NGFW", "XDR Analytics"…
|
||||
source: "source"
|
||||
# results_path = reply.alerts; source_path is JSONata over ONE alert object.
|
||||
# Paths absent from a given alert are skipped at ingestion, so entries for fields
|
||||
# a tenant never emits are safe. Where two entries target the same OCSF field,
|
||||
# the LAST non-empty one wins — that is how the fallbacks below are ordered.
|
||||
ocsf:
|
||||
# ── Finding ───────────────────────────────────────────────────────
|
||||
- { source_path: "alert_id", ocsf_field: "finding_info.uid" }
|
||||
- { source_path: "external_id", ocsf_field: "finding_info.uid_alt" }
|
||||
- { source_path: "name", ocsf_field: "finding_info.title" }
|
||||
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
||||
- { source_path: "detection_timestamp", ocsf_field: "finding_info.created_time" }
|
||||
- { source_path: "local_insert_ts", ocsf_field: "finding_info.modified_time" }
|
||||
- { source_path: "category", ocsf_field: "finding_info.analytic.category" }
|
||||
- { source_path: "name", ocsf_field: "finding_info.analytic.name" }
|
||||
- { source_path: "filter_rule_id", ocsf_field: "finding_info.analytic.uid" }
|
||||
# ── Detection time: the MTTD anchor ───────────────────────────────
|
||||
# `time` is what Riposte measures detection-to-ingestion against. Ingestion
|
||||
# time (source_insert_ts) is the honest fallback when the sensor sent no
|
||||
# detection timestamp of its own — it still beats leaving MTTD empty.
|
||||
- { source_path: "source_insert_ts", ocsf_field: "time" }
|
||||
- { source_path: "detection_timestamp", ocsf_field: "time" }
|
||||
# ── Alert state ───────────────────────────────────────────────────
|
||||
- { source_path: "severity", ocsf_field: "severity" }
|
||||
- { source_path: "alert_type", ocsf_field: "activity_name" }
|
||||
- { source_path: "action_pretty", ocsf_field: "action" }
|
||||
- { source_path: "action", ocsf_field: "action" }
|
||||
- { source_path: "resolution_status", ocsf_field: "status" }
|
||||
- { source_path: "resolution_comment", ocsf_field: "status_detail" }
|
||||
# ── Product identity ──────────────────────────────────────────────
|
||||
- { source_path: "'Cortex XDR'", ocsf_field: "metadata.product.name" }
|
||||
- { source_path: "'Palo Alto Networks'", ocsf_field: "metadata.product.vendor_name" }
|
||||
- { source_path: "source", ocsf_field: "metadata.log_source" }
|
||||
# ── MITRE ATT&CK ──────────────────────────────────────────────────
|
||||
# Both fields arrive as a list on most tenants and as a bare string on some;
|
||||
# [0] reads the first element either way.
|
||||
- { source_path: "mitre_tactic_id_and_name[0]", ocsf_field: "attacks.tactic.name" }
|
||||
- { source_path: "mitre_technique_id_and_name[0]", ocsf_field: "attacks.technique.name" }
|
||||
# ── Affected endpoint ─────────────────────────────────────────────
|
||||
- { source_path: "host_name", ocsf_field: "device.hostname" }
|
||||
- { source_path: "host_ip[0]", ocsf_field: "device.ip" }
|
||||
- { source_path: "mac", ocsf_field: "device.mac" }
|
||||
- { source_path: "endpoint_id", ocsf_field: "device.uid" }
|
||||
- { source_path: "agent_device_domain", ocsf_field: "device.domain" }
|
||||
- { source_path: "agent_os_type", ocsf_field: "device.os.type" }
|
||||
- { source_path: "agent_os_sub_type", ocsf_field: "device.os.name" }
|
||||
# Mirrored onto src_endpoint so routers and pre-processing rules written for
|
||||
# the incident feed (which maps hosts there) match alerts unchanged.
|
||||
- { source_path: "host_name", ocsf_field: "src_endpoint.hostname" }
|
||||
- { source_path: "host_ip[0]", ocsf_field: "src_endpoint.ip" }
|
||||
- { source_path: "user_name", ocsf_field: "user.name" }
|
||||
# ── First triggering event (events[] carries the per-event detail) ─
|
||||
- { source_path: "events[0].actor_process_image_name", ocsf_field: "process.name" }
|
||||
- { source_path: "events[0].actor_process_command_line", ocsf_field: "process.cmd_line" }
|
||||
- { source_path: "events[0].actor_process_image_path", ocsf_field: "process.path" }
|
||||
- { source_path: "events[0].actor_process_os_pid", ocsf_field: "process.pid" }
|
||||
- { source_path: "events[0].actor_process_image_sha256", ocsf_field: "process.file.hashes.sha256" }
|
||||
- { source_path: "events[0].causality_actor_process_image_name", ocsf_field: "process.parent_process.name" }
|
||||
- { source_path: "events[0].causality_actor_process_command_line", ocsf_field: "process.parent_process.cmd_line" }
|
||||
- { source_path: "events[0].action_file_path", ocsf_field: "file.path" }
|
||||
- { source_path: "events[0].action_file_sha256", ocsf_field: "file.hashes.sha256" }
|
||||
- { source_path: "events[0].action_file_md5", ocsf_field: "file.hashes.md5" }
|
||||
- { source_path: "events[0].action_remote_ip", ocsf_field: "dst_endpoint.ip" }
|
||||
- { source_path: "events[0].action_remote_port", ocsf_field: "dst_endpoint.port" }
|
||||
- { source_path: "events[0].action_external_hostname", ocsf_field: "dst_endpoint.hostname" }
|
||||
- { source_path: "events[0].action_local_ip", ocsf_field: "src_endpoint.ip" }
|
||||
- { source_path: "events[0].action_local_port", ocsf_field: "src_endpoint.port" }
|
||||
@@ -2,7 +2,10 @@ name: "Cortex XDR Incidents → OCSF"
|
||||
description: "Maps a Cortex XDR incident (incidents/get_incidents/, results_path = reply.incidents) to OCSF finding fields. Incidents are aggregates; use get_incident_extra_data for per-alert detail."
|
||||
field_mappings:
|
||||
title: "incident_name"
|
||||
severity: "severity = 'critical' ? 5 : (severity = 'high' ? 4 : (severity = 'medium' ? 3 : 2))"
|
||||
# The raw string, not a ternary: the mapping engine compares numbers only, so
|
||||
# every string test read as false and every incident landed on the rule's
|
||||
# default severity. Riposte reads critical/high/medium/low onto 1-5 itself.
|
||||
severity: "severity"
|
||||
description: "description"
|
||||
# results_path = reply.incidents; source_path is JSONata over ONE incident object.
|
||||
# Paths absent from a given incident are skipped at ingestion, so extra entries are safe.
|
||||
@@ -15,6 +18,9 @@ ocsf:
|
||||
- { source_path: "modification_time", ocsf_field: "finding_info.modified_time" }
|
||||
- { source_path: "xdr_url", ocsf_field: "finding_info.src_url" }
|
||||
- { source_path: "status", ocsf_field: "status" }
|
||||
# `time` is the MTTD anchor — when XDR opened the incident, as opposed to when
|
||||
# Riposte ingested it. Without it the detection delay column stays empty.
|
||||
- { source_path: "creation_time", ocsf_field: "time" }
|
||||
- { source_path: "alert_count", ocsf_field: "count" }
|
||||
# ── MITRE ATT&CK (first aggregated tactic/technique) ──────────────
|
||||
- { source_path: "mitre_tactics_ids_and_names[0]", ocsf_field: "attacks.tactic.name" }
|
||||
|
||||
Reference in New Issue
Block a user