name: "CrowdStrike Next-Gen SIEM Detections → OCSF"
description: "First cut of the map of a Falcon Next-Gen SIEM detection (alerts/entities/alerts/v2 filtered on product 'ngsiem', results_path = resources) to OCSF. An NG-SIEM detection is raised by a correlation rule over ingested logs, not by the sensor: it carries no device, process or file block, so none of the EDR paths of search_detections apply. Only the fields every unified alert carries are mapped here; hosts, users, IPs and the source log come with the first real payload."
field_mappings:
  title: "name"
  # Plain path: the ingestion engine reads informational/low/medium/high/critical natively.
  severity: "severity_name"
  description: "description"
# results_path = resources; source_path is JSONata over ONE alert object.
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Finding / analytic ────────────────────────────────────────────
  - { source_path: "composite_id",       ocsf_field: "finding_info.uid" }
  - { source_path: "name",               ocsf_field: "finding_info.title" }
  - { source_path: "description",        ocsf_field: "finding_info.desc" }
  - { source_path: "created_timestamp",  ocsf_field: "finding_info.created_time" }
  - { source_path: "created_timestamp",  ocsf_field: "time" }
  - { source_path: "updated_timestamp",  ocsf_field: "finding_info.modified_time" }
  - { source_path: "type",               ocsf_field: "finding_info.types" }
  - { source_path: "confidence",         ocsf_field: "confidence" }
  - { source_path: "status",             ocsf_field: "status" }
  - { source_path: "product",            ocsf_field: "metadata.product.feature.name" }
  - { source_path: "cid",                ocsf_field: "cloud.account.uid" }
  # ── MITRE ATT&CK ──────────────────────────────────────────────────
  - { source_path: "tactic",       ocsf_field: "attacks.tactic.name" }
  - { source_path: "tactic_id",    ocsf_field: "attacks.tactic.uid" }
  - { source_path: "technique",    ocsf_field: "attacks.technique.name" }
  - { source_path: "technique_id", ocsf_field: "attacks.technique.uid" }