feat(harfanglab): describe an incident with the rule's message (1.7.1)

The get_security_events and get_alerts mappers set an incident's
description to alert_type alone — "sigma", "yara" — which says nothing
an analyst can act on. It now takes msg, the rule's own account of what
it detects and what to check, and falls back to the alert type only on
alerts that carry no message. Folded into the unreleased 1.7.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXFMuDDLohs4qnL12mBJoP

integrations/harfanglab/mappers/get_alerts.yaml

@@ -3,7 +3,9 @@ description: "Maps a HarfangLab EDR alert (/api/data/alert/alert/Alert/, results
 field_mappings:
   title: "rule_name"
   severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
-  description: "alert_type"
+  # msg is the rule's own explanation of what it detects; the alert type
+  # (sigma, yara, ioc…) stands in only on the alerts that carry none.
+  description: "msg ? msg : alert_type"
 # results_path = results; source_path is JSONata over ONE alert object.
 # Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
 ocsf:

integrations/harfanglab/mappers/get_security_events.yaml

@@ -3,7 +3,9 @@ description: "Maps a HarfangLab EDR security event/alert (/api/data/alert/alert/
 field_mappings:
   title: "rule_name"
   severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
-  description: "alert_type"
+  # msg is the rule's own explanation of what it detects; the alert type
+  # (sigma, yara, ioc…) stands in only on the alerts that carry none.
+  description: "msg ? msg : alert_type"
 # results_path = results; source_path is JSONata over ONE alert object.
 # Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
 ocsf: