fix(cortex-xdr): the alerts endpoint never answered — wrong request dialect
get_alerts posted the incidents body, {filters, search_from, search_to, sort},
to alerts/get_alerts_by_filter_data/. That endpoint serves the alerts GRID and
speaks another dialect entirely, so every call — before this branch as much as
after it — came back a bare HTTP 500 with no hint as to why.
Shape taken from the reference client (demisto/content, Packs/ApiModules/
Scripts/CoreIRApiModule, get_alerts_by_filter_command):
request_data.filter_data = {
sort: [{FIELD, ORDER}], # a list, uppercase keys
paging: {from, to}, # not search_from/search_to
filter: {AND: [{SEARCH_FIELD, SEARCH_TYPE, SEARCH_VALUE}]},
}
Severity is an enum there (SEV_040_HIGH), and several severities are OR'd, not
passed as a list. The watermark is a RANGE, since the grid has no gte operator;
its upper bound carries five minutes of slack, because our clock and the
tenant's are not the same clock. A filterless query is bounded to the last
thirty days rather than sent empty — the reference client refuses one outright,
and the grid is not meant to be asked for a whole retention.
The response needed as much work as the request. Rows arrive wrapped as
{alert_fields, incident_fields}, and mapping through that wrapper would put an
alert_fields. prefix on every expression an operator writes, so each row is
unwrapped. Two of its fields cannot be mapped as they stand: severity is the
enum code, and status.progress carries a dot INSIDE the key, which no mapping
path can express. Both are derived into severity_name and status_progress.
The mapper follows the grid's own vocabulary — internal_id, alert_name,
agent_hostname, agent_ip_addresses — and dedup moves to internal_id, since
alert_id belongs to the other API. case_id is kept as the correlation UID: it
is the join back to the incident feed.
Verified end to end against the vendor's own recorded response
(test_data/get_alerts_by_filter_results.json): 33 of 54 OCSF entries resolve on
it, severity lands on 3, the detection anchor is set, and the paging walks
0-100, 100-200, 200-250 with the truncation flag raised only when the ceiling,
not the window, ended the fetch.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -1,76 +1,87 @@
|
||||
name: "Cortex XDR Alerts → OCSF"
|
||||
description: "Maps a Cortex XDR alert (alerts/get_alerts_by_filter_data/, results_path = reply.alerts) to OCSF Detection Finding fields. Alerts are the per-detection layer under incidents: one incident aggregates many alerts, so a tenant ingesting both feeds will hold the same detection twice, once as an aggregate and once on its own."
|
||||
description: "Maps one Cortex XDR alert (alerts/get_alerts_by_filter_data/, results_path = reply.alerts) to OCSF Detection Finding fields. Field names are the alerts-grid ones (internal_id, alert_name, agent_hostname…), not the incident ones; the script unwraps the API's alert_fields envelope and derives severity_name and status_progress, which the raw payload cannot express. Alerts are the detection layer under incidents: a tenant ingesting both feeds holds each detection twice, once inside an aggregate and once on its own."
|
||||
field_mappings:
|
||||
title: "name"
|
||||
description: "description"
|
||||
# The raw string is enough: Riposte reads critical/high/medium/low/informational
|
||||
# onto its 1-5 scale itself, and the mapping engine cannot compare strings.
|
||||
severity: "severity"
|
||||
title: "alert_name"
|
||||
description: "alert_description"
|
||||
# severity_name, not severity: the API sends an enum code (SEV_040_HIGH) that
|
||||
# no severity scale can read, so the script carries the plain name alongside it.
|
||||
severity: "severity_name"
|
||||
# Which sensor fired: "XDR Agent", "PAN NGFW", "XDR Analytics"…
|
||||
source: "source"
|
||||
source: "alert_source"
|
||||
# results_path = reply.alerts; source_path is JSONata over ONE alert object.
|
||||
# Paths absent from a given alert are skipped at ingestion, so entries for fields
|
||||
# a tenant never emits are safe. Where two entries target the same OCSF field,
|
||||
# the LAST non-empty one wins — that is how the fallbacks below are ordered.
|
||||
# the LAST non-empty one wins — that is how the events[] fallbacks are ordered.
|
||||
ocsf:
|
||||
# ── Finding ───────────────────────────────────────────────────────
|
||||
- { source_path: "alert_id", ocsf_field: "finding_info.uid" }
|
||||
- { source_path: "internal_id", ocsf_field: "finding_info.uid" }
|
||||
- { source_path: "external_id", ocsf_field: "finding_info.uid_alt" }
|
||||
- { source_path: "name", ocsf_field: "finding_info.title" }
|
||||
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
||||
- { source_path: "detection_timestamp", ocsf_field: "finding_info.created_time" }
|
||||
- { source_path: "alert_name", ocsf_field: "finding_info.title" }
|
||||
- { source_path: "alert_description", ocsf_field: "finding_info.desc" }
|
||||
- { source_path: "source_insert_ts", ocsf_field: "finding_info.created_time" }
|
||||
- { source_path: "local_insert_ts", ocsf_field: "finding_info.modified_time" }
|
||||
- { source_path: "category", ocsf_field: "finding_info.analytic.category" }
|
||||
- { source_path: "name", ocsf_field: "finding_info.analytic.name" }
|
||||
- { source_path: "filter_rule_id", ocsf_field: "finding_info.analytic.uid" }
|
||||
- { source_path: "alert_category", ocsf_field: "finding_info.analytic.category" }
|
||||
- { source_path: "alert_name", ocsf_field: "finding_info.analytic.name" }
|
||||
- { source_path: "matching_service_rule_id", ocsf_field: "finding_info.analytic.uid" }
|
||||
# ── Detection time: the MTTD anchor ───────────────────────────────
|
||||
# `time` is what Riposte measures detection-to-ingestion against. Ingestion
|
||||
# time (source_insert_ts) is the honest fallback when the sensor sent no
|
||||
# detection timestamp of its own — it still beats leaving MTTD empty.
|
||||
# `time` is what Riposte measures detection-to-ingestion against. The grid
|
||||
# exposes when the tenant took the alert in (source_insert_ts); a sensor-side
|
||||
# detection timestamp, when the tenant sends one, is the better anchor and
|
||||
# comes last so it wins.
|
||||
- { source_path: "source_insert_ts", ocsf_field: "time" }
|
||||
- { source_path: "detection_timestamp", ocsf_field: "time" }
|
||||
# ── Alert state ───────────────────────────────────────────────────
|
||||
- { source_path: "severity", ocsf_field: "severity" }
|
||||
- { source_path: "alert_type", ocsf_field: "activity_name" }
|
||||
- { source_path: "action_pretty", ocsf_field: "action" }
|
||||
- { source_path: "action", ocsf_field: "action" }
|
||||
- { source_path: "resolution_status", ocsf_field: "status" }
|
||||
- { source_path: "resolution_comment", ocsf_field: "status_detail" }
|
||||
- { source_path: "severity_name", ocsf_field: "severity" }
|
||||
- { source_path: "alert_domain", ocsf_field: "activity_name" }
|
||||
- { source_path: "alert_action_status", ocsf_field: "action" }
|
||||
- { source_path: "status_progress", ocsf_field: "status" }
|
||||
- { source_path: "matching_status", ocsf_field: "status_detail" }
|
||||
- { source_path: "events_length", ocsf_field: "count" }
|
||||
# The XDR case this alert was folded into — the join back to the incident feed.
|
||||
- { source_path: "case_id", ocsf_field: "metadata.correlation_uid" }
|
||||
# ── Product identity ──────────────────────────────────────────────
|
||||
- { source_path: "'Cortex XDR'", ocsf_field: "metadata.product.name" }
|
||||
- { source_path: "'Palo Alto Networks'", ocsf_field: "metadata.product.vendor_name" }
|
||||
- { source_path: "source", ocsf_field: "metadata.log_source" }
|
||||
- { source_path: "'Cortex XDR'", ocsf_field: "metadata.product.name" }
|
||||
- { source_path: "'Palo Alto Networks'", ocsf_field: "metadata.product.vendor_name" }
|
||||
- { source_path: "alert_source", ocsf_field: "metadata.log_source" }
|
||||
# ── MITRE ATT&CK ──────────────────────────────────────────────────
|
||||
# Both fields arrive as a list on most tenants and as a bare string on some;
|
||||
# [0] reads the first element either way.
|
||||
- { source_path: "mitre_tactic_id_and_name[0]", ocsf_field: "attacks.tactic.name" }
|
||||
- { source_path: "mitre_technique_id_and_name[0]", ocsf_field: "attacks.technique.name" }
|
||||
# ── Affected endpoint ─────────────────────────────────────────────
|
||||
- { source_path: "host_name", ocsf_field: "device.hostname" }
|
||||
- { source_path: "host_ip[0]", ocsf_field: "device.ip" }
|
||||
- { source_path: "mac", ocsf_field: "device.mac" }
|
||||
- { source_path: "endpoint_id", ocsf_field: "device.uid" }
|
||||
- { source_path: "agent_device_domain", ocsf_field: "device.domain" }
|
||||
- { source_path: "agent_os_type", ocsf_field: "device.os.type" }
|
||||
- { source_path: "agent_os_sub_type", ocsf_field: "device.os.name" }
|
||||
- { source_path: "agent_hostname", ocsf_field: "device.hostname" }
|
||||
- { source_path: "agent_ip_addresses[0]", ocsf_field: "device.ip" }
|
||||
- { source_path: "agent_id", ocsf_field: "device.uid" }
|
||||
- { source_path: "agent_os_type", ocsf_field: "device.os.type" }
|
||||
# Mirrored onto src_endpoint so routers and pre-processing rules written for
|
||||
# the incident feed (which maps hosts there) match alerts unchanged.
|
||||
- { source_path: "host_name", ocsf_field: "src_endpoint.hostname" }
|
||||
- { source_path: "host_ip[0]", ocsf_field: "src_endpoint.ip" }
|
||||
- { source_path: "user_name", ocsf_field: "user.name" }
|
||||
# ── First triggering event (events[] carries the per-event detail) ─
|
||||
- { source_path: "agent_hostname", ocsf_field: "src_endpoint.hostname" }
|
||||
- { source_path: "agent_ip_addresses[0]", ocsf_field: "src_endpoint.ip" }
|
||||
- { source_path: "actor_effective_username", ocsf_field: "user.name" }
|
||||
# ── What actually happened ────────────────────────────────────────
|
||||
# Grid columns first, then the same detail read off the first event, which is
|
||||
# where a tenant that does not flatten these columns puts them.
|
||||
- { source_path: "actor_process_image_name", ocsf_field: "process.name" }
|
||||
- { source_path: "actor_process_command_line", ocsf_field: "process.cmd_line" }
|
||||
- { source_path: "actor_process_image_sha256", ocsf_field: "process.file.hashes.sha256" }
|
||||
- { source_path: "causality_actor_process_command_line", ocsf_field: "process.parent_process.cmd_line" }
|
||||
- { source_path: "action_file_path", ocsf_field: "file.path" }
|
||||
- { source_path: "action_file_sha256", ocsf_field: "file.hashes.sha256" }
|
||||
- { source_path: "action_file_md5", ocsf_field: "file.hashes.md5" }
|
||||
- { source_path: "action_registry_key_name", ocsf_field: "reg_key.path" }
|
||||
- { source_path: "action_registry_data", ocsf_field: "reg_value.data" }
|
||||
- { source_path: "action_local_ip", ocsf_field: "src_endpoint.ip" }
|
||||
- { source_path: "action_local_port", ocsf_field: "src_endpoint.port" }
|
||||
- { source_path: "action_remote_ip", ocsf_field: "dst_endpoint.ip" }
|
||||
- { source_path: "action_remote_port", ocsf_field: "dst_endpoint.port" }
|
||||
- { source_path: "dst_action_external_hostname", ocsf_field: "dst_endpoint.hostname" }
|
||||
- { source_path: "events[0].actor_process_image_name", ocsf_field: "process.name" }
|
||||
- { source_path: "events[0].actor_process_command_line", ocsf_field: "process.cmd_line" }
|
||||
- { source_path: "events[0].actor_process_image_path", ocsf_field: "process.path" }
|
||||
- { source_path: "events[0].actor_process_os_pid", ocsf_field: "process.pid" }
|
||||
- { source_path: "events[0].actor_process_image_sha256", ocsf_field: "process.file.hashes.sha256" }
|
||||
- { source_path: "events[0].causality_actor_process_image_name", ocsf_field: "process.parent_process.name" }
|
||||
- { source_path: "events[0].causality_actor_process_command_line", ocsf_field: "process.parent_process.cmd_line" }
|
||||
- { source_path: "events[0].causality_actor_process_image_name", ocsf_field: "process.parent_process.name" }
|
||||
- { source_path: "events[0].action_file_path", ocsf_field: "file.path" }
|
||||
- { source_path: "events[0].action_file_sha256", ocsf_field: "file.hashes.sha256" }
|
||||
- { source_path: "events[0].action_file_md5", ocsf_field: "file.hashes.md5" }
|
||||
- { source_path: "events[0].action_remote_ip", ocsf_field: "dst_endpoint.ip" }
|
||||
- { source_path: "events[0].action_remote_port", ocsf_field: "dst_endpoint.port" }
|
||||
- { source_path: "events[0].action_external_hostname", ocsf_field: "dst_endpoint.hostname" }
|
||||
- { source_path: "events[0].action_local_ip", ocsf_field: "src_endpoint.ip" }
|
||||
- { source_path: "events[0].action_local_port", ocsf_field: "src_endpoint.port" }
|
||||
|
||||
Reference in New Issue
Block a user