name: "Gmail Single User Messages → OCSF"
description: "Maps a Gmail message (get_incidents, results_path = result) to OCSF finding fields. Messages are flattened by the fetch script (subject/from/to/date extracted from headers)."
field_mappings:
  title: "subject"
  severity: "2"
  description: "snippet"
ocsf:
  - { source_path: "id",        ocsf_field: "finding_info.uid" }
  - { source_path: "thread_id", ocsf_field: "finding_info.uid_alt" }
  - { source_path: "subject",   ocsf_field: "finding_info.title" }
  - { source_path: "snippet",   ocsf_field: "finding_info.desc" }
  - { source_path: "date",      ocsf_field: "finding_info.created_time" }
  - { source_path: "labels",    ocsf_field: "finding_info.types" }
  - { source_path: "from",      ocsf_field: "actor.user.name" }
  - { source_path: "to",        ocsf_field: "user.name" }