name: "SentinelOne Alerts → OCSF"
description: "Exhaustive map of a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF. Initiating (source) process = actor (actor.*); the process/file acted upon = target (process.*/file.*); registry, network, indicators and container included."
field_mappings:
  title: "ruleInfo.name"
  severity: "ruleInfo.severity = 'Critical' ? 5 : (ruleInfo.severity = 'High' ? 4 : 3)"
  description: "alertInfo.eventType"
# source_path is JSONata over ONE alert object (alert rule results_path = data).
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Endpoint / device ─────────────────────────────────────────────
  - { source_path: "agentDetectionInfo.name",          ocsf_field: "src_endpoint.hostname" }
  - { source_path: "agentDetectionInfo.osName",        ocsf_field: "src_endpoint.os.name" }
  - { source_path: "agentDetectionInfo.osFamily",      ocsf_field: "src_endpoint.os.type" }
  - { source_path: "agentDetectionInfo.osRevision",    ocsf_field: "device.os.build" }
  - { source_path: "agentDetectionInfo.uuid",          ocsf_field: "device.uid" }
  - { source_path: "agentDetectionInfo.machineType",   ocsf_field: "device.type" }
  - { source_path: "agentDetectionInfo.version",       ocsf_field: "metadata.product.version" }
  - { source_path: "agentDetectionInfo.accountId",     ocsf_field: "cloud.account.uid" }
  # ── Network (alertInfo) ───────────────────────────────────────────
  - { source_path: "alertInfo.srcIp",                  ocsf_field: "src_endpoint.ip" }
  - { source_path: "alertInfo.dstIp",                  ocsf_field: "dst_endpoint.ip" }
  - { source_path: "alertInfo.dstPort",                ocsf_field: "dst_endpoint.port" }
  - { source_path: "alertInfo.netEventDirection",      ocsf_field: "connection_info.direction" }
  - { source_path: "alertInfo.dnsRequest",             ocsf_field: "dns_query.hostname" }
  # ── Affected login user (alertInfo) ───────────────────────────────
  - { source_path: "alertInfo.loginsUserName",         ocsf_field: "user.name" }
  - { source_path: "alertInfo.loginAccountDomain",     ocsf_field: "user.domain" }
  - { source_path: "alertInfo.loginAccountSid",        ocsf_field: "user.uid" }
  # ── Rule / finding ────────────────────────────────────────────────
  - { source_path: "ruleInfo.name",                    ocsf_field: "rule.name" }
  - { source_path: "ruleInfo.id",                      ocsf_field: "rule.uid" }
  - { source_path: "ruleInfo.description",             ocsf_field: "rule.desc" }
  - { source_path: "alertInfo.alertId",                ocsf_field: "finding_info.uid" }
  - { source_path: "alertInfo.dvEventId",              ocsf_field: "metadata.original_event_uid" }
  - { source_path: "alertInfo.createdAt",              ocsf_field: "finding_info.created_time" }
  - { source_path: "alertInfo.updatedAt",              ocsf_field: "finding_info.modified_time" }
  - { source_path: "alertInfo.hitType",                ocsf_field: "finding_info.analytic.type" }
  - { source_path: "alertInfo.incidentStatus",         ocsf_field: "status" }
  - { source_path: "alertInfo.analystVerdict",         ocsf_field: "status_detail" }
  # ── Threat-intel indicator (observables) ──────────────────────────
  - { source_path: "alertInfo.indicatorName",          ocsf_field: "observables.name" }
  - { source_path: "alertInfo.indicatorCategory",      ocsf_field: "observables.type" }
  - { source_path: "alertInfo.tiIndicatorValue",       ocsf_field: "observables.value" }
  # ── Registry (alertInfo) ──────────────────────────────────────────
  - { source_path: "alertInfo.registryPath",           ocsf_field: "reg_key.path" }
  - { source_path: "alertInfo.registryValue",          ocsf_field: "reg_value.data" }
  # ── Initiating (source) process — the actor ───────────────────────
  - { source_path: "sourceProcessInfo.name",           ocsf_field: "actor.process.name" }
  - { source_path: "sourceProcessInfo.pid",            ocsf_field: "actor.process.pid" }
  - { source_path: "sourceProcessInfo.filePath",       ocsf_field: "actor.process.file.path" }
  - { source_path: "sourceProcessInfo.commandline",    ocsf_field: "actor.process.cmd_line" }
  - { source_path: "sourceProcessInfo.user",           ocsf_field: "actor.user.name" }
  - { source_path: "sourceProcessInfo.integrityLevel", ocsf_field: "actor.process.integrity" }
  - { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "actor.process.file.hashes.sha256" }
  - { source_path: "sourceProcessInfo.fileHashSha1",   ocsf_field: "actor.process.file.hashes.sha1" }
  - { source_path: "sourceProcessInfo.fileHashMd5",    ocsf_field: "actor.process.file.hashes.md5" }
  # ── Parent of the source process ──────────────────────────────────
  - { source_path: "sourceParentProcessInfo.name",        ocsf_field: "actor.process.parent_process.name" }
  - { source_path: "sourceParentProcessInfo.pid",         ocsf_field: "actor.process.parent_process.pid" }
  - { source_path: "sourceParentProcessInfo.commandline", ocsf_field: "actor.process.parent_process.cmd_line" }
  # ── Target process — the process acted upon ───────────────────────
  - { source_path: "targetProcessInfo.tgtProcName",        ocsf_field: "process.name" }
  - { source_path: "targetProcessInfo.tgtProcPid",         ocsf_field: "process.pid" }
  - { source_path: "targetProcessInfo.tgtProcCmdLine",     ocsf_field: "process.cmd_line" }
  - { source_path: "targetProcessInfo.tgtProcImagePath",   ocsf_field: "process.file.path" }
  - { source_path: "targetProcessInfo.tgtProcUid",         ocsf_field: "process.uid" }
  - { source_path: "targetProcessInfo.tgtProcIntegrityLevel", ocsf_field: "process.integrity" }
  # ── Target file — the file acted upon ─────────────────────────────
  - { source_path: "targetProcessInfo.tgtFilePath",       ocsf_field: "file.path" }
  - { source_path: "targetProcessInfo.tgtFileId",         ocsf_field: "file.uid" }
  - { source_path: "targetProcessInfo.tgtFileHashSha256", ocsf_field: "file.hashes.sha256" }
  - { source_path: "targetProcessInfo.tgtFileHashSha1",   ocsf_field: "file.hashes.sha1" }
  - { source_path: "targetProcessInfo.tgtFileCreatedAt",  ocsf_field: "file.created_time" }
  - { source_path: "targetProcessInfo.tgtFileModifiedAt", ocsf_field: "file.modified_time" }
  # ── Container ─────────────────────────────────────────────────────
  - { source_path: "containerInfo.name",               ocsf_field: "container.name" }
  - { source_path: "containerInfo.id",                 ocsf_field: "container.uid" }
  - { source_path: "containerInfo.image",              ocsf_field: "container.image.name" }