docs(mappers): MTTD is not retired, only re-anchored
The previous commit said MTTD was retired. Migration 0256 did retire it, but 0257 restored it at once: what stays is its anchor, the moment Riposte records the alert. The OCSF `time` field is still not read to date detection — that part was right. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
@@ -51,8 +51,9 @@ ocsf:
|
||||
- { source_path: "rule.rrn", ocsf_field: "finding_info.analytic.uid" }
|
||||
- { source_path: "rule.version_rrn", ocsf_field: "finding_info.analytic.version" }
|
||||
# ── Event time (OCSF `time`) ───────────────────────────────────────
|
||||
# Riposte no longer reads it to date detection (MTTD retired, migration 0256):
|
||||
# it is the alert's own record of when the source saw the event.
|
||||
# Riposte no longer reads it to date detection: since migration 0256, MTTD
|
||||
# starts when Riposte records the alert. It is the alert's own record of when
|
||||
# the source saw the event.
|
||||
# alerted_at is when the underlying event happened in the source system; created_at is
|
||||
# when Rapid7 finished building the alert. Weakest first, strongest last.
|
||||
- { source_path: "created_at", ocsf_field: "time" }
|
||||
|
||||
Reference in New Issue
Block a user