diff --git a/integrations/harfanglab/mappers/get_threats.yaml b/integrations/harfanglab/mappers/get_threats.yaml
index 611b336..5127c9d 100644
--- a/integrations/harfanglab/mappers/get_threats.yaml
+++ b/integrations/harfanglab/mappers/get_threats.yaml
@@ -13,17 +13,22 @@ ocsf:
   - { source_path: "creation_date", ocsf_field: "finding_info.created_time" }
   - { source_path: "first_seen",    ocsf_field: "finding_info.first_seen_time" }
   - { source_path: "last_seen",     ocsf_field: "finding_info.last_seen_time" }
-  - { source_path: "closed_date",   ocsf_field: "end_time" }
-  - { source_path: "status",        ocsf_field: "status" }
-  - { source_path: "linked_threat", ocsf_field: "finding_info.uid_alt" }
-  - { source_path: "tenant",        ocsf_field: "metadata.tenant_uid" }
+  # x ? x guards: these are null on open/mono-tenant threats — null is falsy in
+  # JSONata, so the condition yields undefined and the entry is skipped instead
+  # of writing a literal null into the OCSF document.
+  - { source_path: "closed_date ? closed_date",     ocsf_field: "end_time" }
+  - { source_path: "status",                        ocsf_field: "status" }
+  - { source_path: "linked_threat ? linked_threat", ocsf_field: "finding_info.uid_alt" }
+  - { source_path: "tenant ? tenant",               ocsf_field: "metadata.tenant_uid" }
   # ── Aggregate counts ──────────────────────────────────────────────
   - { source_path: "total_security_event_count", ocsf_field: "finding_info.related_events_count" }
   - { source_path: "agent_count",          ocsf_field: "unmapped.agent_count" }
   - { source_path: "impacted_user_count",  ocsf_field: "unmapped.impacted_user_count" }
   - { source_path: "rule_count",           ocsf_field: "unmapped.rule_count" }
   # ── MITRE ATT&CK — mitre_tactics is a MAP {"attack.persistence": {...}} ──
-  - { source_path: "$keys(mitre_tactics)", ocsf_field: "attacks" }
+  # [$keys(...)] keeps an array shape even for a single tactic (JSONata collapses
+  # singleton sequences to a scalar); the guard skips threats without tactics.
+  - { source_path: "mitre_tactics ? [$keys(mitre_tactics)]", ocsf_field: "attacks" }
   # ── Top impacted endpoint (most security events first) ────────────
   - { source_path: "top_agents[0].agent_hostname",      ocsf_field: "src_endpoint.hostname" }
   - { source_path: "top_agents[0].agent_id",            ocsf_field: "device.uid" }
@@ -39,6 +44,7 @@ ocsf:
   - { source_path: "top_rules[0].rule_type", ocsf_field: "finding_info.analytic.type" }
   - { source_path: "top_rules[0].rule_msg",  ocsf_field: "finding_info.desc" }
 # Deliberately unmapped: old_id/origin_stack (legacy/console internals), agent_status,
+# top_rules[0].id (numeric console id — rule_id is the stable uid, mapped above),
 # per-item security_event_count, rule_os/rule_level/rule creation dates (no OCSF home),
 # top_rules[0].description (duplicate of rule_msg), and entries [1..] of the top_* arrays
 # (OCSF detection_finding models a single primary endpoint/user/rule; counts convey scale).