feat(recorded-future): Recorded Future + ASI integrations

Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/ file/cve risk reputation, full entity intelligence, and alert ingestion (alerts search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus alert lookup and alert-rule search. Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails API, APIKEY header, project-scoped). Project issue ingestion (project_issues) with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by a configurable minimum severity, plus recent-issues and recent-issues-by-host queries. The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 15:19:40 +02:00
parent ef215daa88
commit fcf516ca82
20 changed files with 862 additions and 0 deletions
@@ -0,0 +1,19 @@
+name: "Recorded Future Alerts → OCSF"
+description: "Maps a Recorded Future alert (/v2/alert/search, results_path = data.results) to OCSF Detection Finding fields. Alerts are generated by alerting rules over Recorded Future intelligence."
+field_mappings:
+  title: "title"
+# results_path = data.results; source_path is JSONata over ONE alert object.
+# Paths absent from a given alert return nothing and are skipped.
+ocsf:
+  # ── Finding ───────────────────────────────────────────────────────
+  - { source_path: "id",             ocsf_field: "finding_info.uid" }
+  - { source_path: "title",          ocsf_field: "finding_info.title" }
+  - { source_path: "triggered",      ocsf_field: "finding_info.created_time" }
+  - { source_path: "url",            ocsf_field: "finding_info.src_url" }
+  # ── Triggering rule (analytic) ────────────────────────────────────
+  - { source_path: "rule.name",      ocsf_field: "finding_info.analytic.name" }
+  - { source_path: "rule.id",        ocsf_field: "finding_info.analytic.uid" }
+  # ── Incident state ────────────────────────────────────────────────
+  - { source_path: "review.status",  ocsf_field: "status" }
+  - { source_path: "type",           ocsf_field: "activity_name" }
+  - { source_path: "review.assignee", ocsf_field: "assignee.name" }