name: "SentinelOne Threats → OCSF"
description: "Exhaustive map of a SentinelOne v2.1 threat object (data[]) to OCSF. Malicious file = subject (file.*/malware.*); originating process = actor (actor.*); host's logged-in user = affected user (user.*)."
field_mappings:
  title: "threatInfo.threatName"
  severity: "threatInfo.confidenceLevel = 'malicious' ? 4 : 3"
  description: "threatInfo.classification"
# source_path is JSONata over ONE threat object (alert rule results_path = data).
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Endpoint / device ─────────────────────────────────────────────
  - { source_path: "agentRealtimeInfo.agentComputerName", ocsf_field: "src_endpoint.hostname" }
  - { source_path: "agentRealtimeInfo.agentDomain",       ocsf_field: "src_endpoint.domain" }
  - { source_path: "agentRealtimeInfo.agentOsType",       ocsf_field: "src_endpoint.os.type" }
  - { source_path: "agentRealtimeInfo.agentMachineType",  ocsf_field: "device.type" }
  - { source_path: "agentRealtimeInfo.agentUuid",         ocsf_field: "device.uid" }
  - { source_path: "agentRealtimeInfo.agentId",           ocsf_field: "device.uid_alt" }
  - { source_path: "agentDetectionInfo.externalIp",       ocsf_field: "src_endpoint.ip" }
  - { source_path: "agentDetectionInfo.agentIpV4",        ocsf_field: "device.ip" }
  - { source_path: "agentDetectionInfo.agentOsName",      ocsf_field: "src_endpoint.os.name" }
  - { source_path: "agentDetectionInfo.agentOsRevision",  ocsf_field: "device.os.build" }
  - { source_path: "agentDetectionInfo.agentVersion",     ocsf_field: "metadata.product.version" }
  - { source_path: "agentDetectionInfo.agentRegisteredAt", ocsf_field: "device.first_seen_time" }
  - { source_path: "agentDetectionInfo.accountName",      ocsf_field: "cloud.account.name" }
  - { source_path: "agentDetectionInfo.accountId",        ocsf_field: "cloud.account.uid" }
  # ── Affected user (logged in on the host) ─────────────────────────
  - { source_path: "agentDetectionInfo.agentLastLoggedInUserName", ocsf_field: "user.name" }
  # ── Finding / malware ─────────────────────────────────────────────
  - { source_path: "threatInfo.threatName",               ocsf_field: "malware.name" }
  - { source_path: "threatInfo.classification",           ocsf_field: "malware.classifications" }
  - { source_path: "threatInfo.threatId",                 ocsf_field: "finding_info.uid" }
  - { source_path: "threatInfo.createdAt",                ocsf_field: "finding_info.created_time" }
  - { source_path: "threatInfo.identifiedAt",             ocsf_field: "finding_info.first_seen_time" }
  - { source_path: "threatInfo.updatedAt",                ocsf_field: "finding_info.modified_time" }
  - { source_path: "threatInfo.detectionType",            ocsf_field: "finding_info.analytic.type" }
  - { source_path: "threatInfo.confidenceLevel",          ocsf_field: "confidence" }
  - { source_path: "threatInfo.incidentStatus",           ocsf_field: "status" }
  - { source_path: "threatInfo.analystVerdict",           ocsf_field: "status_detail" }
  - { source_path: "threatInfo.mitigationStatus",         ocsf_field: "status_code" }
  - { source_path: "threatInfo.storyline",                ocsf_field: "metadata.correlation_uid" }
  # ── Acting (malicious) process — the actor ────────────────────────
  - { source_path: "threatInfo.originatorProcess",        ocsf_field: "actor.process.name" }
  - { source_path: "threatInfo.maliciousProcessArguments", ocsf_field: "actor.process.cmd_line" }
  - { source_path: "threatInfo.processUser",              ocsf_field: "actor.user.name" }
  # ── Malicious file — the subject ──────────────────────────────────
  - { source_path: "threatInfo.filePath",                 ocsf_field: "file.path" }
  - { source_path: "threatInfo.fileExtension",            ocsf_field: "file.ext" }
  - { source_path: "threatInfo.fileExtensionType",        ocsf_field: "file.type" }
  - { source_path: "threatInfo.fileSize",                 ocsf_field: "file.size" }
  - { source_path: "threatInfo.publisherName",            ocsf_field: "file.company_name" }
  - { source_path: "threatInfo.sha256",                   ocsf_field: "file.hashes.sha256" }
  - { source_path: "threatInfo.sha1",                     ocsf_field: "file.hashes.sha1" }
  - { source_path: "threatInfo.md5",                      ocsf_field: "file.hashes.md5" }