feat(webhook-relay): map Rapid7 InsightIDR basic rule alerts (1.1.0)

fetch_rapid7_alerts opens the alert InsightIDR Essential posts as a JSON
string in a single payload field (JSON or form body) and returns one flat
item per relayed message; the correlation id is the dedup key. Own mapper
and alert type, written from a real delivery.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xa1QDbsPTYiVREv2Cvs3Zn

integrations/webhook-relay/mappers/fetch_rapid7_alerts.yaml

@@ -0,0 +1,59 @@
+name: "Rapid7 InsightIDR basic rule (via Webhook Relay)"
+description: |
+  Maps one Rapid7 InsightIDR Essential basic detection rule alert, received by the
+  relay's Webhook notification, to an alert. fetch_rapid7_alerts has already opened
+  the payload (a JSON string in a `payload` field): each item carries rule,
+  correlation_id, event_time, log_set, log_name, hostname, log_line (log_event when
+  the line is JSON) and the relay's own fields (id, source, received_at, verified).
+
+  The payload has no severity and names no user or source address of its own: those
+  live in the log line, which Rapid7 leaves out unless the rule includes it. When it
+  is left out, log_line_withheld is true and the description says so — turn on the
+  log line in the rule's notification, or the alert only says which rule fired.
+
+  `host.name` in Rapid7's payload is the log set (Asset Authentication), not a
+  machine; it goes to unmapped.rapid7.log_set. device.hostname takes host.hostname,
+  which basic rules often leave null.
+field_mappings:
+  title: "jsonata: rule ? rule : ('Rapid7 · ' & source)"
+  source: "jsonata: 'Rapid7 InsightIDR'"
+  description: "jsonata: decode_error ? ('Undecodable Rapid7 delivery (' & decode_error & '):\n' & $substring(body, 0, 8000)) : ('Rapid7 InsightIDR basic rule: ' & rule & '\nLog set: ' & (log_set ? log_set : '—') & ' · log: ' & (log_name ? log_name : '—') & (hostname ? '\nHost: ' & hostname : '') & (event_time ? '\nEvent time: ' & event_time : '') & '\n\n' & (log_line_withheld ? 'Log line withheld by the rule: enable it in the rule notification to see the triggering event.' : (log_line ? 'Log line:\n' & $substring(log_line, 0, 8000) : '')))"
+  "custom:webhook_source": "source"
+  "custom:webhook_verified": "jsonata: $join(verified, ',')"
+  "custom:webhook_message_id": "id"
+  "custom:webhook_received_at": "received_at"
+  "custom:webhook_sender_ip": "remote_ip"
+  "custom:webhook_payload": "jsonata: log_event ? $toTable(log_event) : rapid7 ? $toTable({'rule': rule, 'log_set': log_set, 'log': log_name, 'hostname': hostname, 'event_time': event_time, 'region': region, 'correlation_id': correlation_id}) : body"
+ocsf:
+  # ── Finding ───────────────────────────────────────────────────────
+  # Rapid7's correlation id (falls back to relay:<message id> for an undecodable
+  # delivery) — also the command's dedup key.
+  - { source_path: "alert_id",        ocsf_field: "finding_info.uid" }
+  - { source_path: "rule",            ocsf_field: "finding_info.title" }
+  - { source_path: "rule",            ocsf_field: "finding_info.analytic.name" }
+  - { source_path: "'Rule'",          ocsf_field: "finding_info.analytic.type" }
+  - { source_path: "event_time",      ocsf_field: "finding_info.created_time" }
+  # The time of the log event that fired the rule; receipt stays in logged_time.
+  - { source_path: "event_time ? event_time : received_at", ocsf_field: "time" }
+  - { source_path: "received_at",     ocsf_field: "metadata.logged_time" }
+  - { source_path: "id",              ocsf_field: "metadata.uid" }
+  - { source_path: "correlation_id",  ocsf_field: "metadata.correlation_uid" }
+  # ── Product ───────────────────────────────────────────────────────
+  - { source_path: "'InsightIDR'",    ocsf_field: "metadata.product.name" }
+  - { source_path: "'Rapid7'",        ocsf_field: "metadata.product.vendor_name" }
+  - { source_path: "'riposte-relay'", ocsf_field: "metadata.log_provider" }
+  - { source_path: "source",          ocsf_field: "metadata.log_name" }
+  - { source_path: "[verified.('relay:' & $)]", ocsf_field: "metadata.labels" }
+  - { source_path: "body",            ocsf_field: "raw_data" }
+  # ── Asset ─────────────────────────────────────────────────────────
+  - { source_path: "hostname",        ocsf_field: "device.hostname" }
+  # ── Rapid7 specifics ──────────────────────────────────────────────
+  - { source_path: "log_set",         ocsf_field: "unmapped.rapid7.log_set" }
+  - { source_path: "log_name",        ocsf_field: "unmapped.rapid7.log_name" }
+  - { source_path: "log_key",         ocsf_field: "unmapped.rapid7.log_key" }
+  - { source_path: "region",          ocsf_field: "unmapped.rapid7.region" }
+  - { source_path: "event_sequence",  ocsf_field: "unmapped.rapid7.event_sequence" }
+  - { source_path: "log_line",        ocsf_field: "unmapped.rapid7.log_line" }
+  - { source_path: "log_line_withheld", ocsf_field: "unmapped.rapid7.log_line_withheld" }
+  # The vendor's cloud, never an entity (see the generic mapper).
+  - { source_path: "remote_ip",       ocsf_field: "unmapped.relay.sender_ip" }