f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(rapid7-insightidr): read the evidence in both of its shapes (v1.9.2)

Browse Source 
evidence_fields came back {} on a live run. The evidence was fetched, the run
was clean — one call, 1.3s, no error — and the parser found nothing in it.

`data` does not have one shape. The parser was written against an unparsed
Fortigate source and looked only for {source_data, custom_data}. A PARSED
source has no such wrapper: the event is the object.

  {user, account, source_ip, geoip_country_code, geoip_organization,
   result, service, user_agent, source_json{…}, r7_context{…},
   detection_context{…}}

Every one of those is what the incident was missing, sitting one json.loads
away, and the parser walked past all of it and returned an empty dict. No error
— which is how it survived a run that reported success.

Now both are read as a union rather than one or the other: scalars at the top
level are always taken, so a third shape still yields its plain fields instead
of nothing, and the wrapped keys are overlaid when present. source_json is
skipped — several kilobytes of vendor payload that stay in the raw line —
while r7_context and detection_context are flattened one level, being Rapid7's
own annotations and the same across parsed sources. They carry the account age
in minutes, which is exactly what says whether a sign-in is from a new account.

The Azure AD sign-in now maps to src_endpoint.ip, .isp_org and
.location.country, actor.user.name/.uid/.account.name, http_request.user_agent
and metadata.product.feature.name, and indexes the address and the account.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-09-08 16:19:08 +02:00
parent 2d6e097742
commit e19530d3f3
3 changed files with 62 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/rapid7-insightidr/mappers/get_investigations_full.yaml
+11
View File
@@ -150,6 +150,17 @@ ocsf:
# that names its fields the usual way.
- { source_path: "alerts[0].evidence_fields", ocsf_field: "evidence" }
- { source_path: "alerts[0].evidence_fields.srcip", ocsf_field: "src_endpoint.ip" }
# A parsed source states the same things under its own names. Both spellings
# are mapped rather than picked between: which one arrives depends on whether
# the log source was parsed by Rapid7, and one file has to serve both.
- { source_path: "alerts[0].evidence_fields.source_ip", ocsf_field: "src_endpoint.ip" }
- { source_path: "alerts[0].evidence_fields.account", ocsf_field: "actor.user.account.name" }
- { source_path: "alerts[0].evidence_fields.user_rrn", ocsf_field: "actor.user.uid" }
- { source_path: "alerts[0].evidence_fields.geoip_country_code", ocsf_field: "src_endpoint.location.country" }
- { source_path: "alerts[0].evidence_fields.geoip_organization", ocsf_field: "src_endpoint.isp_org" }
- { source_path: "alerts[0].evidence_fields.user_agent", ocsf_field: "http_request.user_agent" }
- { source_path: "alerts[0].evidence_fields.service", ocsf_field: "metadata.product.feature.name" }
- { source_path: "alerts[0].evidence_fields.result", ocsf_field: "status_detail" }
- { source_path: "alerts[0].evidence_fields.dstip", ocsf_field: "dst_endpoint.ip" }
- { source_path: "alerts[0].evidence_fields.srcport", ocsf_field: "src_endpoint.port" }
- { source_path: "alerts[0].evidence_fields.dstport", ocsf_field: "dst_endpoint.port" }