diff --git a/integrations/sentinelone/manifest.yaml b/integrations/sentinelone/manifest.yaml
index 2bb6866..fcd5b4c 100644
--- a/integrations/sentinelone/manifest.yaml
+++ b/integrations/sentinelone/manifest.yaml
@@ -1,8 +1,8 @@
 id: sentinelone
 name: SentinelOne
-version: 1.2.1
+version: 1.2.2
 description: "SentinelOne Singularity (API v2.1) — endpoint detection & response: triage threats, enrich, isolate/reconnect hosts, mitigate, scan."
-changelog: "1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
+changelog: "1.2.2 — Added pre-built OCSF mappers (get_threats, get_alerts) for the mapper library. 1.2.1 — Added test_connection for the instance Test button. 1.2.0 — Added 13 commands: threat-analysis, threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file, get-remote-script-task-status/results, get-service-users, list-installed-singularity-marketplace-applications, update-uam-alert-status/verdict, run-powerquery and create-tag-rule (83 commands total). 1.1.0 — Command names prefixed with 'sentinelone-' (e.g. sentinelone-isolate-agent) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: 70 commands covering agents, threats, alerts, blocklist/exclusions, IOCs, STAR rules, Deep Visibility, remote scripts, tags, firewall and network discovery based on the SentinelOne API v2.1."
 category: endpoint
 
 # Per-instance configuration. The scripts build the API base as <url>/web/api/v2.1.
diff --git a/integrations/sentinelone/mappers/get_alerts.yaml b/integrations/sentinelone/mappers/get_alerts.yaml
new file mode 100644
index 0000000..31a14d7
--- /dev/null
+++ b/integrations/sentinelone/mappers/get_alerts.yaml
@@ -0,0 +1,12 @@
+name: "SentinelOne Alerts → OCSF"
+description: "Maps a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF endpoint/file/process fields."
+field_mappings:
+  title: "ruleInfo.name"
+  severity: "ruleInfo.severity = 'Critical' ? 5 : (ruleInfo.severity = 'High' ? 4 : 3)"
+  description: "alertInfo.eventType"
+ocsf:
+  - { source_path: "agentDetectionInfo.name",          ocsf_field: "src_endpoint.hostname" }
+  - { source_path: "agentDetectionInfo.osName",        ocsf_field: "src_endpoint.os.name" }
+  - { source_path: "sourceProcessInfo.filePath",       ocsf_field: "process.file.path" }
+  - { source_path: "sourceProcessInfo.commandline",    ocsf_field: "process.cmd_line" }
+  - { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "file.hashes.sha256" }
diff --git a/integrations/sentinelone/mappers/get_threats.yaml b/integrations/sentinelone/mappers/get_threats.yaml
new file mode 100644
index 0000000..652f6b8
--- /dev/null
+++ b/integrations/sentinelone/mappers/get_threats.yaml
@@ -0,0 +1,13 @@
+name: "SentinelOne Threats → OCSF"
+description: "Maps a SentinelOne v2.1 threat object (data[]) to OCSF endpoint/file/process fields."
+field_mappings:
+  title: "threatInfo.threatName"
+  severity: "threatInfo.confidenceLevel = 'malicious' ? 4 : 3"
+  description: "threatInfo.classification"
+ocsf:
+  - { source_path: "agentRealtimeInfo.agentComputerName", ocsf_field: "src_endpoint.hostname" }
+  - { source_path: "agentDetectionInfo.externalIp",        ocsf_field: "src_endpoint.ip" }
+  - { source_path: "agentDetectionInfo.agentOsName",       ocsf_field: "src_endpoint.os.name" }
+  - { source_path: "threatInfo.sha256",                    ocsf_field: "file.hashes.sha256" }
+  - { source_path: "threatInfo.filePath",                  ocsf_field: "file.path" }
+  - { source_path: "threatInfo.maliciousProcessArguments", ocsf_field: "process.cmd_line" }