f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(mock-edr-s1): map the OCSF-shaped incident payload

Browse Source 
The mock now emits incidents already in an OCSF-aligned shape (src_endpoint,
device, user, rule, dst_endpoint, dns_query, cloud, metadata). Map those nested
fields through to OCSF instead of only the flat OpenAPI fields.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-06-27 16:20:53 +02:00
parent 7e96048446
commit b99de4af19
1 changed files with 32 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/mock-edr-s1/mappers/list_incidents.yaml
+32 -8
View File
@@ -1,5 +1,5 @@
name: "Mock EDR Incidents → OCSF" name: "Mock EDR Incidents → OCSF"
description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields." description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields. Events already arrive in an OCSF-aligned shape, so most paths map through directly."
field_mappings: field_mappings:
title: "title" title: "title"
description: "description" description: "description"
@@ -9,15 +9,39 @@ field_mappings:
# results_path = items; source_path is JSONata over ONE incident object. # results_path = items; source_path is JSONata over ONE incident object.
ocsf: ocsf:
# ── Finding ─────────────────────────────────────────────────────── # ── Finding ───────────────────────────────────────────────────────
- { source_path: "id", ocsf_field: "finding_info.uid" } - { source_path: "external_id", ocsf_field: "finding_info.uid" }
- { source_path: "external_id", ocsf_field: "metadata.uid" }
- { source_path: "title", ocsf_field: "finding_info.title" } - { source_path: "title", ocsf_field: "finding_info.title" }
- { source_path: "description", ocsf_field: "finding_info.desc" } - { source_path: "description", ocsf_field: "finding_info.desc" }
- { source_path: "created_at", ocsf_field: "finding_info.created_time" } - { source_path: "created_at", ocsf_field: "finding_info.created_time" }
- { source_path: "updated_at", ocsf_field: "finding_info.modified_time" }
- { source_path: "status", ocsf_field: "status" } - { source_path: "status", ocsf_field: "status" }
- { source_path: "source", ocsf_field: "metadata.product.name" } # ── Detection rule (analytic) ─────────────────────────────────────
# ── Affected host / artefact ────────────────────────────────────── - { source_path: "rule.name", ocsf_field: "finding_info.analytic.name" }
- { source_path: "hostname", ocsf_field: "src_endpoint.hostname" } - { source_path: "rule.uid", ocsf_field: "finding_info.analytic.uid" }
- { source_path: "ip_address", ocsf_field: "src_endpoint.ip" } - { source_path: "rule.desc", ocsf_field: "finding_info.analytic.desc" }
- { source_path: "hostname", ocsf_field: "device.hostname" } # ── Affected host (source endpoint / device) ──────────────────────
- { source_path: "src_endpoint.hostname", ocsf_field: "src_endpoint.hostname" }
- { source_path: "src_endpoint.ip", ocsf_field: "src_endpoint.ip" }
- { source_path: "src_endpoint.os.name", ocsf_field: "src_endpoint.os.name" }
- { source_path: "src_endpoint.os.type", ocsf_field: "src_endpoint.os.type" }
- { source_path: "src_endpoint.hostname", ocsf_field: "device.hostname" }
- { source_path: "device.uid", ocsf_field: "device.uid" }
- { source_path: "device.type", ocsf_field: "device.type" }
- { source_path: "device.os.build", ocsf_field: "device.os.build" }
- { source_path: "src_endpoint.os.name", ocsf_field: "device.os.name" }
# ── Network (destination / connection / DNS) ──────────────────────
- { source_path: "dst_endpoint.ip", ocsf_field: "dst_endpoint.ip" }
- { source_path: "dst_endpoint.port", ocsf_field: "dst_endpoint.port" }
- { source_path: "connection_info.direction", ocsf_field: "connection_info.direction" }
- { source_path: "dns_query.hostname", ocsf_field: "dns_query.hostname" }
# ── User ──────────────────────────────────────────────────────────
- { source_path: "user.name", ocsf_field: "user.name" }
- { source_path: "user.domain", ocsf_field: "user.domain" }
- { source_path: "user.uid", ocsf_field: "user.uid" }
# ── File artefact ─────────────────────────────────────────────────
- { source_path: "file_path", ocsf_field: "file.path" } - { source_path: "file_path", ocsf_field: "file.path" }
# ── Cloud / metadata ──────────────────────────────────────────────
- { source_path: "cloud.account.uid", ocsf_field: "cloud.account.uid" }
- { source_path: "metadata.original_event_uid", ocsf_field: "metadata.uid" }
- { source_path: "source", ocsf_field: "metadata.product.name" }
- { source_path: "metadata.product.version", ocsf_field: "metadata.product.version" }