name: "Splunk Notable / CIM → OCSF"
description: "Maps a Splunk notable / CIM finding row (search results_path = results) to OCSF Finding fields. Built for ES notable events surfaced by the `notable` macro (rule_title/rule_name/urgency/security_domain) enriched with CIM Network/Authentication fields (src/dest/user/dvc). Severity is normalised to the OCSF 1-5 scale from the notable `urgency`."
field_mappings:
  title: "rule_title ? rule_title : (source ? source : event_id)"
  # urgency: informational/low -> low, up to critical=5 (OCSF 1-5 scale).
  severity: "urgency = 'critical' ? 5 : (urgency = 'high' ? 4 : (urgency = 'medium' ? 3 : (urgency = 'low' ? 2 : 1)))"
  description: "rule_description"
# results_path = results; source_path is JSONata over ONE result row.
# Fields absent from a given row are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "event_id",         ocsf_field: "finding_info.uid" }
  - { source_path: "rule_title",       ocsf_field: "finding_info.title" }
  - { source_path: "rule_description", ocsf_field: "finding_info.desc" }
  - { source_path: "`_time`",          ocsf_field: "finding_info.created_time" }
  - { source_path: "security_domain",  ocsf_field: "finding_info.analytic.category" }
  - { source_path: "status_label",     ocsf_field: "status" }
  # ── Rule (correlation search) / provenance ────────────────────────
  - { source_path: "rule_name",        ocsf_field: "rule.name" }
  - { source_path: "rule_description", ocsf_field: "rule.desc" }
  - { source_path: "signature",        ocsf_field: "metadata.event_code" }
  - { source_path: "source",           ocsf_field: "metadata.log_name" }
  - { source_path: "sourcetype",       ocsf_field: "metadata.log_source" }
  # ── Source endpoint (CIM Network) ─────────────────────────────────
  - { source_path: "src",              ocsf_field: "src_endpoint.hostname" }
  - { source_path: "src_ip",           ocsf_field: "src_endpoint.ip" }
  - { source_path: "src_port",         ocsf_field: "src_endpoint.port" }
  # ── Destination endpoint (CIM Network) ────────────────────────────
  - { source_path: "dest",             ocsf_field: "dst_endpoint.hostname" }
  - { source_path: "dest_ip",          ocsf_field: "dst_endpoint.ip" }
  - { source_path: "dest_port",        ocsf_field: "dst_endpoint.port" }
  # ── Affected device / users (CIM) ─────────────────────────────────
  - { source_path: "dvc",              ocsf_field: "device.hostname" }
  - { source_path: "user",             ocsf_field: "user.name" }
  - { source_path: "src_user",         ocsf_field: "actor.user.name" }