f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(microsoft-sentinel): new Microsoft Sentinel integration

Browse Source 
19 commands (Azure Resource Manager API): incident ingestion + CRUD,
comments, related alerts/entities/relations, watchlists, and threat
indicators. Azure AD OAuth 2.0 client-credentials, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-07-11 22:22:46 +02:00
parent 811a85424b
commit 334ecac83e
22 changed files with 1781 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/microsoft-sentinel/mappers/get_incidents.yaml
+18
View File
@@ -0,0 +1,18 @@
name: "Microsoft Sentinel Incidents → OCSF"
description: "Maps a Sentinel incident (get_incidents, results_path = result) to OCSF finding fields. The fetch script lifts the ARM 'properties' object to the top level and keeps the incident 'name' (GUID) as the id."
field_mappings:
title: "title"
severity: "severity = 'High' ? 4 : (severity = 'Medium' ? 3 : (severity = 'Low' ? 2 : 1))"
description: "description"
ocsf:
- { source_path: "name", ocsf_field: "finding_info.uid" }
- { source_path: "incidentNumber", ocsf_field: "finding_info.uid_alt" }
- { source_path: "title", ocsf_field: "finding_info.title" }
- { source_path: "description", ocsf_field: "finding_info.desc" }
- { source_path: "createdTimeUtc", ocsf_field: "finding_info.created_time" }
- { source_path: "lastModifiedTimeUtc", ocsf_field: "finding_info.modified_time" }
- { source_path: "incidentUrl", ocsf_field: "finding_info.src_url" }
- { source_path: "status", ocsf_field: "status" }
- { source_path: "classification", ocsf_field: "disposition" }
- { source_path: "owner.assignedTo", ocsf_field: "assignee.name" }
- { source_path: "labels[0].labelName", ocsf_field: "finding_info.types" }