docs(mappers): MTTD is not retired, only re-anchored

The previous commit said MTTD was retired. Migration 0256 did retire it,
but 0257 restored it at once: what stays is its anchor, the moment
Riposte records the alert. The OCSF `time` field is still not read to
date detection — that part was right.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-10-07 09:58:20 +00:00
parent ece2c41340
commit db9a45c9bc
8 changed files with 24 additions and 16 deletions
@@ -51,8 +51,9 @@ ocsf:
- { source_path: "rule.rrn", ocsf_field: "finding_info.analytic.uid" }
- { source_path: "rule.version_rrn", ocsf_field: "finding_info.analytic.version" }
# ── Event time (OCSF `time`) ───────────────────────────────────────
# Riposte no longer reads it to date detection (MTTD retired, migration 0256):
# it is the alert's own record of when the source saw the event.
# Riposte no longer reads it to date detection: since migration 0256, MTTD
# starts when Riposte records the alert. It is the alert's own record of when
# the source saw the event.
# alerted_at is when the underlying event happened in the source system; created_at is
# when Rapid7 finished building the alert. Weakest first, strongest last.
- { source_path: "created_at", ocsf_field: "time" }