From ece2c41340881e2a67c1222a8fa8b2ebf992ae1e Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Wed, 7 Oct 2026 09:56:50 +0000 Subject: [PATCH] docs(mappers): `time` no longer dates detection Eight mappers (Cortex XDR, CrowdStrike, Rapid7) still called the OCSF `time` field "the MTTD anchor" that Riposte reads to stamp detected_at. Riposte retired MTTD in migration 0256 and stamps detection at ingestion for every alert; the mappings stay, as the alert's own record of when the source saw the event. Comments only: no mapping changes. Co-Authored-By: Claude Opus 5.5 --- integrations/cortex-xdr/mappers/get_alerts.yaml | 11 ++++++----- integrations/cortex-xdr/mappers/get_incidents.yaml | 6 ++++-- .../cortex-xdr/mappers/get_incidents_full.yaml | 4 +++- .../crowdstrike/mappers/search_detections.yaml | 8 +++----- .../mappers/get_investigations_full.yaml | 4 +++- integrations/rapid7-insightidr/mappers/query_log.yaml | 7 ++++--- .../rapid7-insightidr/mappers/query_log_set.yaml | 7 ++++--- .../rapid7-insightidr/mappers/search_alerts.yaml | 4 +++- 8 files changed, 30 insertions(+), 21 deletions(-) diff --git a/integrations/cortex-xdr/mappers/get_alerts.yaml b/integrations/cortex-xdr/mappers/get_alerts.yaml index 907dcaf..6c15efa 100644 --- a/integrations/cortex-xdr/mappers/get_alerts.yaml +++ b/integrations/cortex-xdr/mappers/get_alerts.yaml @@ -23,11 +23,12 @@ ocsf: - { source_path: "alert_category", ocsf_field: "finding_info.analytic.category" } - { source_path: "alert_name", ocsf_field: "finding_info.analytic.name" } - { source_path: "matching_service_rule_id", ocsf_field: "finding_info.analytic.uid" } - # ── Detection time: the MTTD anchor ─────────────────────────────── - # `time` is what Riposte measures detection-to-ingestion against. The grid - # exposes when the tenant took the alert in (source_insert_ts); a sensor-side - # detection timestamp, when the tenant sends one, is the better anchor and - # comes last so it wins. + # ── Event time (OCSF `time`) ─────────────────────────────────────── + # Riposte no longer reads it to date detection (MTTD retired, migration 0256): + # it is the alert's own record of when the source saw the event. + # The grid exposes when the tenant took the alert in (source_insert_ts); a + # sensor-side detection timestamp, when the tenant sends one, is closer to the + # event and comes last so it wins. - { source_path: "source_insert_ts", ocsf_field: "time" } - { source_path: "detection_timestamp", ocsf_field: "time" } # ── Alert state ─────────────────────────────────────────────────── diff --git a/integrations/cortex-xdr/mappers/get_incidents.yaml b/integrations/cortex-xdr/mappers/get_incidents.yaml index 00bd1a1..58a7995 100644 --- a/integrations/cortex-xdr/mappers/get_incidents.yaml +++ b/integrations/cortex-xdr/mappers/get_incidents.yaml @@ -18,8 +18,10 @@ ocsf: - { source_path: "modification_time", ocsf_field: "finding_info.modified_time" } - { source_path: "xdr_url", ocsf_field: "finding_info.src_url" } - { source_path: "status", ocsf_field: "status" } - # `time` is the MTTD anchor — when XDR opened the incident, as opposed to when - # Riposte ingested it. Without it the detection delay column stays empty. + # `time` is the OCSF event time — when XDR opened the incident, as opposed to + # when Riposte ingested it. + # Riposte no longer reads it to date detection (MTTD retired, migration 0256): + # it is the alert's own record of when the source saw the event. - { source_path: "creation_time", ocsf_field: "time" } - { source_path: "alert_count", ocsf_field: "count" } # ── MITRE ATT&CK (first aggregated tactic/technique) ────────────── diff --git a/integrations/cortex-xdr/mappers/get_incidents_full.yaml b/integrations/cortex-xdr/mappers/get_incidents_full.yaml index d937f33..6c3fafb 100644 --- a/integrations/cortex-xdr/mappers/get_incidents_full.yaml +++ b/integrations/cortex-xdr/mappers/get_incidents_full.yaml @@ -35,7 +35,9 @@ ocsf: # The detection that opened the incident, so an analyst reading the aggregate # can still pivot to the single alert in the XDR console. - { source_path: "alerts[0].alert_id", ocsf_field: "finding_info.uid_alt" } - # ── Detection time: the MTTD anchor ─────────────────────────────── + # ── Event time (OCSF `time`) ─────────────────────────────────────── + # Riposte no longer reads it to date detection (MTTD retired, migration 0256): + # it is the alert's own record of when the source saw the event. # Weakest first, strongest last. detection_time is often null on an XDR # incident, and then the first alert's own detection timestamp is the honest # anchor; incident creation is the last resort. diff --git a/integrations/crowdstrike/mappers/search_detections.yaml b/integrations/crowdstrike/mappers/search_detections.yaml index d0901ab..0bb88bb 100644 --- a/integrations/crowdstrike/mappers/search_detections.yaml +++ b/integrations/crowdstrike/mappers/search_detections.yaml @@ -27,11 +27,9 @@ ocsf: - { source_path: "name", ocsf_field: "finding_info.title" } - { source_path: "description", ocsf_field: "finding_info.desc" } - { source_path: "created_timestamp", ocsf_field: "finding_info.created_time" } - # `time` is the MTTD anchor: the ingestion engine reads THIS field and no other - # to stamp detected_at. Without it the incident is anchored at ingestion, so the - # delay between Falcon detecting and Riposte collecting — over a day on a slow - # poll — is measured as zero. finding_info.created_time below does NOT serve - # this: it is the finding's own record of the same instant, read by nothing. + # `time` is the OCSF event time: when Falcon raised the alert. + # Riposte no longer reads it to date detection (MTTD retired, migration 0256): + # it is the alert's own record of when the source saw the event. - { source_path: "created_timestamp", ocsf_field: "time" } - { source_path: "updated_timestamp", ocsf_field: "finding_info.modified_time" } - { source_path: "scenario", ocsf_field: "finding_info.analytic.name" } diff --git a/integrations/rapid7-insightidr/mappers/get_investigations_full.yaml b/integrations/rapid7-insightidr/mappers/get_investigations_full.yaml index 645c3ec..36457a3 100644 --- a/integrations/rapid7-insightidr/mappers/get_investigations_full.yaml +++ b/integrations/rapid7-insightidr/mappers/get_investigations_full.yaml @@ -67,7 +67,9 @@ ocsf: - { source_path: "organization_id", ocsf_field: "cloud.org.uid" } - { source_path: "assignee.name", ocsf_field: "assignee.name" } - { source_path: "assignee.email", ocsf_field: "assignee.email_addr" } - # ── Detection time: the MTTD anchor ─────────────────────────────── + # ── Event time (OCSF `time`) ─────────────────────────────────────── + # Riposte no longer reads it to date detection (MTTD retired, migration 0256): + # it is the alert's own record of when the source saw the event. # Weakest first, strongest last. The investigation is created after the alert that # opened it; the alert's own alerted_at is when the event happened in the source system. - { source_path: "created_time", ocsf_field: "time" } diff --git a/integrations/rapid7-insightidr/mappers/query_log.yaml b/integrations/rapid7-insightidr/mappers/query_log.yaml index 7ec652e..d5bfecf 100644 --- a/integrations/rapid7-insightidr/mappers/query_log.yaml +++ b/integrations/rapid7-insightidr/mappers/query_log.yaml @@ -41,9 +41,10 @@ ocsf: - { source_path: "detection_name", ocsf_field: "finding_info.title" } - { source_path: "detection_name", ocsf_field: "finding_info.analytic.name" } - { source_path: "$fromMillis(timestamp)", ocsf_field: "finding_info.created_time" } - # ── Detection time: the MTTD anchor ─────────────────────────────── - # The log's own timestamp, not the poll's. A feed that ran late must not make the - # detection look late with it. + # ── Event time (OCSF `time`) ─────────────────────────────────────── + # Riposte no longer reads it to date detection (MTTD retired, migration 0256): + # it is the alert's own record of when the source saw the event. + # The log's own timestamp, not the poll's. - { source_path: "$fromMillis(timestamp)", ocsf_field: "time" } # ── Product identity ────────────────────────────────────────────── - { source_path: "'Rapid7 InsightIDR'", ocsf_field: "metadata.product.name" } diff --git a/integrations/rapid7-insightidr/mappers/query_log_set.yaml b/integrations/rapid7-insightidr/mappers/query_log_set.yaml index 08a4301..fbd4f48 100644 --- a/integrations/rapid7-insightidr/mappers/query_log_set.yaml +++ b/integrations/rapid7-insightidr/mappers/query_log_set.yaml @@ -40,9 +40,10 @@ ocsf: - { source_path: "detection_name", ocsf_field: "finding_info.title" } - { source_path: "detection_name", ocsf_field: "finding_info.analytic.name" } - { source_path: "$fromMillis(timestamp)", ocsf_field: "finding_info.created_time" } - # ── Detection time: the MTTD anchor ─────────────────────────────── - # The log's own timestamp, not the poll's. A feed that ran late must not make the - # detection look late with it. + # ── Event time (OCSF `time`) ─────────────────────────────────────── + # Riposte no longer reads it to date detection (MTTD retired, migration 0256): + # it is the alert's own record of when the source saw the event. + # The log's own timestamp, not the poll's. - { source_path: "$fromMillis(timestamp)", ocsf_field: "time" } # ── Product identity ────────────────────────────────────────────── - { source_path: "'Rapid7 InsightIDR'", ocsf_field: "metadata.product.name" } diff --git a/integrations/rapid7-insightidr/mappers/search_alerts.yaml b/integrations/rapid7-insightidr/mappers/search_alerts.yaml index 1e9c4fe..72c4906 100644 --- a/integrations/rapid7-insightidr/mappers/search_alerts.yaml +++ b/integrations/rapid7-insightidr/mappers/search_alerts.yaml @@ -50,7 +50,9 @@ ocsf: - { source_path: "type", ocsf_field: "finding_info.analytic.name" } - { source_path: "rule.rrn", ocsf_field: "finding_info.analytic.uid" } - { source_path: "rule.version_rrn", ocsf_field: "finding_info.analytic.version" } - # ── Detection time: the MTTD anchor ─────────────────────────────── + # ── Event time (OCSF `time`) ─────────────────────────────────────── + # Riposte no longer reads it to date detection (MTTD retired, migration 0256): + # it is the alert's own record of when the source saw the event. # alerted_at is when the underlying event happened in the source system; created_at is # when Rapid7 finished building the alert. Weakest first, strongest last. - { source_path: "created_at", ocsf_field: "time" }