feat(mock-edr-s1): EDR incident integration from OpenAPI spec

Built from the published OpenAPI spec for mock instance s1 (type: edr). Incident ingestion (list_incidents) with since/after_id paging and an OCSF mapper + 'Mock EDR Incident' default type, plus an acknowledge/resolve/dismiss incident action. X-API-Key auth; the instance path segment is configurable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 16:00:04 +02:00
parent 934f2c52d7
commit 7e96048446
6 changed files with 221 additions and 0 deletions
@@ -0,0 +1,23 @@
+name: "Mock EDR Incidents → OCSF"
+description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields."
+field_mappings:
+  title: "title"
+  description: "description"
+  source: "source"
+  # toSeverity maps critical→5, high→3, medium→2, low→1, informational→1.
+  severity: "severity"
+# results_path = items; source_path is JSONata over ONE incident object.
+ocsf:
+  # ── Finding ───────────────────────────────────────────────────────
+  - { source_path: "id",          ocsf_field: "finding_info.uid" }
+  - { source_path: "external_id", ocsf_field: "metadata.uid" }
+  - { source_path: "title",       ocsf_field: "finding_info.title" }
+  - { source_path: "description", ocsf_field: "finding_info.desc" }
+  - { source_path: "created_at",  ocsf_field: "finding_info.created_time" }
+  - { source_path: "status",      ocsf_field: "status" }
+  - { source_path: "source",      ocsf_field: "metadata.product.name" }
+  # ── Affected host / artefact ──────────────────────────────────────
+  - { source_path: "hostname",    ocsf_field: "src_endpoint.hostname" }
+  - { source_path: "ip_address",  ocsf_field: "src_endpoint.ip" }
+  - { source_path: "hostname",    ocsf_field: "device.hostname" }
+  - { source_path: "file_path",   ocsf_field: "file.path" }