diff --git a/integrations/mock-edr-s1/mappers/list_incidents.yaml b/integrations/mock-edr-s1/mappers/list_incidents.yaml
index 70ffa55..8fd3277 100644
--- a/integrations/mock-edr-s1/mappers/list_incidents.yaml
+++ b/integrations/mock-edr-s1/mappers/list_incidents.yaml
@@ -1,5 +1,5 @@
 name: "Mock EDR Incidents → OCSF"
-description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields."
+description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields. Events already arrive in an OCSF-aligned shape, so most paths map through directly."
 field_mappings:
   title: "title"
   description: "description"
@@ -9,15 +9,39 @@ field_mappings:
 # results_path = items; source_path is JSONata over ONE incident object.
 ocsf:
   # ── Finding ───────────────────────────────────────────────────────
-  - { source_path: "id",          ocsf_field: "finding_info.uid" }
-  - { source_path: "external_id", ocsf_field: "metadata.uid" }
+  - { source_path: "external_id", ocsf_field: "finding_info.uid" }
   - { source_path: "title",       ocsf_field: "finding_info.title" }
   - { source_path: "description", ocsf_field: "finding_info.desc" }
   - { source_path: "created_at",  ocsf_field: "finding_info.created_time" }
+  - { source_path: "updated_at",  ocsf_field: "finding_info.modified_time" }
   - { source_path: "status",      ocsf_field: "status" }
-  - { source_path: "source",      ocsf_field: "metadata.product.name" }
-  # ── Affected host / artefact ──────────────────────────────────────
-  - { source_path: "hostname",    ocsf_field: "src_endpoint.hostname" }
-  - { source_path: "ip_address",  ocsf_field: "src_endpoint.ip" }
-  - { source_path: "hostname",    ocsf_field: "device.hostname" }
+  # ── Detection rule (analytic) ─────────────────────────────────────
+  - { source_path: "rule.name",   ocsf_field: "finding_info.analytic.name" }
+  - { source_path: "rule.uid",    ocsf_field: "finding_info.analytic.uid" }
+  - { source_path: "rule.desc",   ocsf_field: "finding_info.analytic.desc" }
+  # ── Affected host (source endpoint / device) ──────────────────────
+  - { source_path: "src_endpoint.hostname", ocsf_field: "src_endpoint.hostname" }
+  - { source_path: "src_endpoint.ip",       ocsf_field: "src_endpoint.ip" }
+  - { source_path: "src_endpoint.os.name",  ocsf_field: "src_endpoint.os.name" }
+  - { source_path: "src_endpoint.os.type",  ocsf_field: "src_endpoint.os.type" }
+  - { source_path: "src_endpoint.hostname", ocsf_field: "device.hostname" }
+  - { source_path: "device.uid",            ocsf_field: "device.uid" }
+  - { source_path: "device.type",           ocsf_field: "device.type" }
+  - { source_path: "device.os.build",       ocsf_field: "device.os.build" }
+  - { source_path: "src_endpoint.os.name",  ocsf_field: "device.os.name" }
+  # ── Network (destination / connection / DNS) ──────────────────────
+  - { source_path: "dst_endpoint.ip",          ocsf_field: "dst_endpoint.ip" }
+  - { source_path: "dst_endpoint.port",        ocsf_field: "dst_endpoint.port" }
+  - { source_path: "connection_info.direction", ocsf_field: "connection_info.direction" }
+  - { source_path: "dns_query.hostname",       ocsf_field: "dns_query.hostname" }
+  # ── User ──────────────────────────────────────────────────────────
+  - { source_path: "user.name",   ocsf_field: "user.name" }
+  - { source_path: "user.domain", ocsf_field: "user.domain" }
+  - { source_path: "user.uid",    ocsf_field: "user.uid" }
+  # ── File artefact ─────────────────────────────────────────────────
   - { source_path: "file_path",   ocsf_field: "file.path" }
+  # ── Cloud / metadata ──────────────────────────────────────────────
+  - { source_path: "cloud.account.uid",           ocsf_field: "cloud.account.uid" }
+  - { source_path: "metadata.original_event_uid", ocsf_field: "metadata.uid" }
+  - { source_path: "source",                      ocsf_field: "metadata.product.name" }
+  - { source_path: "metadata.product.version",    ocsf_field: "metadata.product.version" }