docs(mappers): time no longer dates detection

Eight mappers (Cortex XDR, CrowdStrike, Rapid7) still called the OCSF
`time` field "the MTTD anchor" that Riposte reads to stamp detected_at.
Riposte retired MTTD in migration 0256 and stamps detection at
ingestion for every alert; the mappings stay, as the alert's own record
of when the source saw the event. Comments only: no mapping changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

integrations/cortex-xdr/mappers/get_alerts.yaml

@@ -23,11 +23,12 @@ ocsf:
   - { source_path: "alert_category",       ocsf_field: "finding_info.analytic.category" }
   - { source_path: "alert_name",           ocsf_field: "finding_info.analytic.name" }
   - { source_path: "matching_service_rule_id", ocsf_field: "finding_info.analytic.uid" }
-  # ── Detection time: the MTTD anchor ───────────────────────────────
+  # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # `time` is what Riposte measures detection-to-ingestion against. The grid
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # exposes when the tenant took the alert in (source_insert_ts); a sensor-side
+  # it is the alert's own record of when the source saw the event.
-  # detection timestamp, when the tenant sends one, is the better anchor and
+  # The grid exposes when the tenant took the alert in (source_insert_ts); a
-  # comes last so it wins.
+  # sensor-side detection timestamp, when the tenant sends one, is closer to the
+  # event and comes last so it wins.
   - { source_path: "source_insert_ts",     ocsf_field: "time" }
   - { source_path: "detection_timestamp",  ocsf_field: "time" }
   # ── Alert state ───────────────────────────────────────────────────

integrations/cortex-xdr/mappers/get_incidents.yaml

@@ -18,8 +18,10 @@ ocsf:
   - { source_path: "modification_time",  ocsf_field: "finding_info.modified_time" }
   - { source_path: "xdr_url",            ocsf_field: "finding_info.src_url" }
   - { source_path: "status",             ocsf_field: "status" }
-  # `time` is the MTTD anchor — when XDR opened the incident, as opposed to when
+  # `time` is the OCSF event time — when XDR opened the incident, as opposed to
-  # Riposte ingested it. Without it the detection delay column stays empty.
+  # when Riposte ingested it.
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
+  # it is the alert's own record of when the source saw the event.
   - { source_path: "creation_time",      ocsf_field: "time" }
   - { source_path: "alert_count",        ocsf_field: "count" }
   # ── MITRE ATT&CK (first aggregated tactic/technique) ──────────────

integrations/cortex-xdr/mappers/get_incidents_full.yaml

@@ -35,7 +35,9 @@ ocsf:
   # The detection that opened the incident, so an analyst reading the aggregate
   # can still pivot to the single alert in the XDR console.
   - { source_path: "alerts[0].alert_id",  ocsf_field: "finding_info.uid_alt" }
-  # ── Detection time: the MTTD anchor ───────────────────────────────
+  # ── Event time (OCSF `time`) ───────────────────────────────────────
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
+  # it is the alert's own record of when the source saw the event.
   # Weakest first, strongest last. detection_time is often null on an XDR
   # incident, and then the first alert's own detection timestamp is the honest
   # anchor; incident creation is the last resort.

integrations/crowdstrike/mappers/search_detections.yaml

@@ -27,11 +27,9 @@ ocsf:
   - { source_path: "name",               ocsf_field: "finding_info.title" }
   - { source_path: "description",        ocsf_field: "finding_info.desc" }
   - { source_path: "created_timestamp",  ocsf_field: "finding_info.created_time" }
-  # `time` is the MTTD anchor: the ingestion engine reads THIS field and no other
+  # `time` is the OCSF event time: when Falcon raised the alert.
-  # to stamp detected_at. Without it the incident is anchored at ingestion, so the
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # delay between Falcon detecting and Riposte collecting — over a day on a slow
+  # it is the alert's own record of when the source saw the event.
-  # poll — is measured as zero. finding_info.created_time below does NOT serve
-  # this: it is the finding's own record of the same instant, read by nothing.
   - { source_path: "created_timestamp",  ocsf_field: "time" }
   - { source_path: "updated_timestamp",  ocsf_field: "finding_info.modified_time" }
   - { source_path: "scenario",           ocsf_field: "finding_info.analytic.name" }

integrations/rapid7-insightidr/mappers/get_investigations_full.yaml

@@ -67,7 +67,9 @@ ocsf:
   - { source_path: "organization_id",    ocsf_field: "cloud.org.uid" }
   - { source_path: "assignee.name",      ocsf_field: "assignee.name" }
   - { source_path: "assignee.email",     ocsf_field: "assignee.email_addr" }
-  # ── Detection time: the MTTD anchor ───────────────────────────────
+  # ── Event time (OCSF `time`) ───────────────────────────────────────
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
+  # it is the alert's own record of when the source saw the event.
   # Weakest first, strongest last. The investigation is created after the alert that
   # opened it; the alert's own alerted_at is when the event happened in the source system.
   - { source_path: "created_time",       ocsf_field: "time" }

integrations/rapid7-insightidr/mappers/query_log.yaml

@@ -41,9 +41,10 @@ ocsf:
   - { source_path: "detection_name", ocsf_field: "finding_info.title" }
   - { source_path: "detection_name", ocsf_field: "finding_info.analytic.name" }
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "finding_info.created_time" }
-  # ── Detection time: the MTTD anchor ───────────────────────────────
+  # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # The log's own timestamp, not the poll's. A feed that ran late must not make the
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # detection look late with it.
+  # it is the alert's own record of when the source saw the event.
+  # The log's own timestamp, not the poll's.
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "time" }
   # ── Product identity ──────────────────────────────────────────────
   - { source_path: "'Rapid7 InsightIDR'", ocsf_field: "metadata.product.name" }

integrations/rapid7-insightidr/mappers/query_log_set.yaml

@@ -40,9 +40,10 @@ ocsf:
   - { source_path: "detection_name", ocsf_field: "finding_info.title" }
   - { source_path: "detection_name", ocsf_field: "finding_info.analytic.name" }
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "finding_info.created_time" }
-  # ── Detection time: the MTTD anchor ───────────────────────────────
+  # ── Event time (OCSF `time`) ───────────────────────────────────────
-  # The log's own timestamp, not the poll's. A feed that ran late must not make the
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
-  # detection look late with it.
+  # it is the alert's own record of when the source saw the event.
+  # The log's own timestamp, not the poll's.
   - { source_path: "$fromMillis(timestamp)", ocsf_field: "time" }
   # ── Product identity ──────────────────────────────────────────────
   - { source_path: "'Rapid7 InsightIDR'", ocsf_field: "metadata.product.name" }

integrations/rapid7-insightidr/mappers/search_alerts.yaml

@@ -50,7 +50,9 @@ ocsf:
   - { source_path: "type",                    ocsf_field: "finding_info.analytic.name" }
   - { source_path: "rule.rrn",                ocsf_field: "finding_info.analytic.uid" }
   - { source_path: "rule.version_rrn",        ocsf_field: "finding_info.analytic.version" }
-  # ── Detection time: the MTTD anchor ───────────────────────────────
+  # ── Event time (OCSF `time`) ───────────────────────────────────────
+  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
+  # it is the alert's own record of when the source saw the event.
   # alerted_at is when the underlying event happened in the source system; created_at is
   # when Rapid7 finished building the alert. Weakest first, strongest last.
   - { source_path: "created_at",              ocsf_field: "time" }