f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(harfanglab): rework get_threats OCSF mapper from live threat sample

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-07-21 22:49:31 +02:00
parent 952dc7efda
commit 4ea3af6c1d
2 changed files with 31 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/harfanglab/mappers/get_threats.yaml
+30 -9
View File
@@ -1,9 +1,9 @@
name: "HarfangLab Threats → OCSF"
description: "Maps a raw HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results) to OCSF. Uses native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics); the agents/impacted_users/rules arrays are only populated by external enrichment, which this connector does not perform."
description: "Maps a raw HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results) to OCSF. Uses native threat fields; top_agents/top_impacted_users/top_rules are ranked aggregates — the first (most impacted) entry feeds the endpoint/user/rule fields. mitre_tactics is a map keyed by tactic slug (e.g. attack.persistence); its keys are extracted with $keys()."
field_mappings:
title: "slug"
title: "top_rules[0].rule_name ? top_rules[0].rule_name & ' — ' & slug : slug"
severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
description: "status"
description: "top_rules[0].rule_msg ? top_rules[0].rule_msg : status"
# results_path = results; source_path is JSONata over ONE threat object.
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
ocsf:
@@ -13,11 +13,32 @@ ocsf:
- { source_path: "creation_date", ocsf_field: "finding_info.created_time" }
- { source_path: "first_seen", ocsf_field: "finding_info.first_seen_time" }
- { source_path: "last_seen", ocsf_field: "finding_info.last_seen_time" }
- { source_path: "last_update", ocsf_field: "finding_info.modified_time" }
- { source_path: "closed_date", ocsf_field: "end_time" }
- { source_path: "status", ocsf_field: "status" }
# ── MITRE ATT&CK (native mitre_tactics list) ──────────────────────
- { source_path: "mitre_tactics[0]", ocsf_field: "attacks.tactic.name" }
# ── Top impacted endpoint / user / rule (native aggregates) ───────
- { source_path: "top_agents[0].agent_hostname", ocsf_field: "src_endpoint.hostname" }
- { source_path: "linked_threat", ocsf_field: "finding_info.uid_alt" }
- { source_path: "tenant", ocsf_field: "metadata.tenant_uid" }
# ── Aggregate counts ──────────────────────────────────────────────
- { source_path: "total_security_event_count", ocsf_field: "finding_info.related_events_count" }
- { source_path: "agent_count", ocsf_field: "unmapped.agent_count" }
- { source_path: "impacted_user_count", ocsf_field: "unmapped.impacted_user_count" }
- { source_path: "rule_count", ocsf_field: "unmapped.rule_count" }
# ── MITRE ATT&CK — mitre_tactics is a MAP {"attack.persistence": {...}} ──
- { source_path: "$keys(mitre_tactics)", ocsf_field: "attacks" }
# ── Top impacted endpoint (most security events first) ────────────
- { source_path: "top_agents[0].agent_hostname", ocsf_field: "src_endpoint.hostname" }
- { source_path: "top_agents[0].agent_id", ocsf_field: "device.uid" }
- { source_path: "top_agents[0].agent_osproducttype", ocsf_field: "src_endpoint.os.name" }
- { source_path: "top_agents[0].agent_ostype", ocsf_field: "src_endpoint.os.type" }
- { source_path: "top_agents[0].agent_osversion", ocsf_field: "device.os.version" }
# ── Top impacted user ─────────────────────────────────────────────
- { source_path: "top_impacted_users[0].user_name", ocsf_field: "user.name" }
- { source_path: "top_rules[0].rule_name", ocsf_field: "rule.name" }
- { source_path: "top_impacted_users[0].user_sid", ocsf_field: "user.uid" }
# ── Top rule ──────────────────────────────────────────────────────
- { source_path: "top_rules[0].rule_name", ocsf_field: "rule.name" }
- { source_path: "top_rules[0].rule_id", ocsf_field: "rule.uid" }
- { source_path: "top_rules[0].rule_type", ocsf_field: "finding_info.analytic.type" }
- { source_path: "top_rules[0].rule_msg", ocsf_field: "finding_info.desc" }
# Deliberately unmapped: old_id/origin_stack (legacy/console internals), agent_status,
# per-item security_event_count, rule_os/rule_level/rule creation dates (no OCSF home),
# top_rules[0].description (duplicate of rule_msg), and entries [1..] of the top_* arrays
# (OCSF detection_finding models a single primary endpoint/user/rule; counts convey scale).