name: "Rapid7 InsightIDR basic rule (via Webhook Relay)"
description: |
  Maps one Rapid7 InsightIDR Essential basic detection rule alert, received by the
  relay's Webhook notification, to an alert. fetch_rapid7_alerts has already opened
  the payload (a JSON string in a `payload` field): each item carries rule,
  correlation_id, event_time, log_set, log_name, hostname, log_line (log_event when
  the line is JSON) and the relay's own fields (id, source, received_at, verified).

  The payload has no severity and names no user or source address of its own: those
  live in the log line, which Rapid7 leaves out unless the rule includes it. When it
  is left out, log_line_withheld is true and the description says so — turn on the
  log line in the rule's notification, or the alert only says which rule fired.

  `host.name` in Rapid7's payload is the log set (Asset Authentication), not a
  machine; it goes to unmapped.rapid7.log_set. device.hostname takes host.hostname,
  which basic rules often leave null.
field_mappings:
  title: "jsonata: rule ? rule : ('Rapid7 · ' & source)"
  source: "jsonata: 'Rapid7 InsightIDR'"
  description: "jsonata: decode_error ? ('Undecodable Rapid7 delivery (' & decode_error & '):\n' & $substring(body, 0, 8000)) : ('Rapid7 InsightIDR basic rule: ' & rule & '\nLog set: ' & (log_set ? log_set : '—') & ' · log: ' & (log_name ? log_name : '—') & (hostname ? '\nHost: ' & hostname : '') & (event_time ? '\nEvent time: ' & event_time : '') & '\n\n' & (log_line_withheld ? 'Log line withheld by the rule: enable it in the rule notification to see the triggering event.' : (log_line ? 'Log line:\n' & $substring(log_line, 0, 8000) : '')))"
  "custom:webhook_source": "source"
  "custom:webhook_verified": "jsonata: $join(verified, ',')"
  "custom:webhook_message_id": "id"
  "custom:webhook_received_at": "received_at"
  "custom:webhook_sender_ip": "remote_ip"
  "custom:webhook_payload": "jsonata: log_event ? $toTable(log_event) : rapid7 ? $toTable({'rule': rule, 'log_set': log_set, 'log': log_name, 'hostname': hostname, 'event_time': event_time, 'region': region, 'correlation_id': correlation_id}) : body"
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  # Rapid7's correlation id (falls back to relay:<message id> for an undecodable
  # delivery) — also the command's dedup key.
  - { source_path: "alert_id",        ocsf_field: "finding_info.uid" }
  - { source_path: "rule",            ocsf_field: "finding_info.title" }
  - { source_path: "rule",            ocsf_field: "finding_info.analytic.name" }
  - { source_path: "'Rule'",          ocsf_field: "finding_info.analytic.type" }
  - { source_path: "event_time",      ocsf_field: "finding_info.created_time" }
  # The time of the log event that fired the rule; receipt stays in logged_time.
  - { source_path: "event_time ? event_time : received_at", ocsf_field: "time" }
  - { source_path: "received_at",     ocsf_field: "metadata.logged_time" }
  - { source_path: "id",              ocsf_field: "metadata.uid" }
  - { source_path: "correlation_id",  ocsf_field: "metadata.correlation_uid" }
  # ── Product ───────────────────────────────────────────────────────
  - { source_path: "'InsightIDR'",    ocsf_field: "metadata.product.name" }
  - { source_path: "'Rapid7'",        ocsf_field: "metadata.product.vendor_name" }
  - { source_path: "'riposte-relay'", ocsf_field: "metadata.log_provider" }
  - { source_path: "source",          ocsf_field: "metadata.log_name" }
  - { source_path: "[verified.('relay:' & $)]", ocsf_field: "metadata.labels" }
  - { source_path: "body",            ocsf_field: "raw_data" }
  # ── Asset ─────────────────────────────────────────────────────────
  - { source_path: "hostname",        ocsf_field: "device.hostname" }
  # ── Rapid7 specifics ──────────────────────────────────────────────
  - { source_path: "log_set",         ocsf_field: "unmapped.rapid7.log_set" }
  - { source_path: "log_name",        ocsf_field: "unmapped.rapid7.log_name" }
  - { source_path: "log_key",         ocsf_field: "unmapped.rapid7.log_key" }
  - { source_path: "region",          ocsf_field: "unmapped.rapid7.region" }
  - { source_path: "event_sequence",  ocsf_field: "unmapped.rapid7.event_sequence" }
  - { source_path: "log_line",        ocsf_field: "unmapped.rapid7.log_line" }
  - { source_path: "log_line_withheld", ocsf_field: "unmapped.rapid7.log_line_withheld" }
  # The vendor's cloud, never an entity (see the generic mapper).
  - { source_path: "remote_ip",       ocsf_field: "unmapped.relay.sender_ip" }