name: "VirusTotal Livehunt Files → OCSF"
description: "Maps a VirusTotal Livehunt notification file (intelligence/hunting_notification_files, results_path = data) to OCSF Detection Finding fields. Each item is a file that matched a Livehunt YARA ruleset."
field_mappings:
  title: "attributes.meaningful_name"
  # Bucket the number of malicious AV detections onto the 1-5 incident scale.
  # No parentheses (right-associative); the lowest band uses '>= 0 ? 1' so the literal sits in a then-branch.
  severity: "attributes.last_analysis_stats.malicious >= 20 ? 5 : attributes.last_analysis_stats.malicious >= 10 ? 4 : attributes.last_analysis_stats.malicious >= 5 ? 3 : attributes.last_analysis_stats.malicious >= 1 ? 2 : attributes.last_analysis_stats.malicious >= 0 ? 1 : 1"
# results_path = data; source_path is JSONata over ONE file object.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "id",                                ocsf_field: "finding_info.uid" }
  - { source_path: "attributes.meaningful_name",        ocsf_field: "finding_info.title" }
  - { source_path: "context_attributes.notification_date", ocsf_field: "finding_info.created_time" }
  - { source_path: "attributes.first_submission_date",  ocsf_field: "finding_info.first_seen_time" }
  - { source_path: "attributes.last_submission_date",   ocsf_field: "finding_info.last_seen_time" }
  - { source_path: "attributes.reputation",             ocsf_field: "risk_score" }
  - { source_path: "attributes.last_analysis_stats.malicious", ocsf_field: "count" }
  # ── Matching Livehunt rule (analytic) ─────────────────────────────
  - { source_path: "context_attributes.rule_name",      ocsf_field: "finding_info.analytic.name" }
  - { source_path: "context_attributes.ruleset_name",   ocsf_field: "finding_info.analytic.uid" }
  - { source_path: "context_attributes.ruleset_name",   ocsf_field: "malware.name" }
  # ── Matched file ──────────────────────────────────────────────────
  - { source_path: "attributes.meaningful_name",        ocsf_field: "file.name" }
  - { source_path: "attributes.type_description",       ocsf_field: "file.type" }
  - { source_path: "attributes.size",                   ocsf_field: "file.size" }
  - { source_path: "attributes.sha256",                 ocsf_field: "file.hashes.sha256" }
  - { source_path: "attributes.sha1",                   ocsf_field: "file.hashes.sha1" }
  - { source_path: "attributes.md5",                    ocsf_field: "file.hashes.md5" }
  - { source_path: "attributes.ssdeep",                 ocsf_field: "file.hashes.ssdeep" }