name: "HarfangLab Threats → OCSF"
description: "Maps a raw HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results) to OCSF. Uses native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics); the agents/impacted_users/rules arrays only exist after XSOAR-side enrichment, which this connector does not perform."
field_mappings:
  title: "slug"
  severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
  description: "status"
# results_path = results; source_path is JSONata over ONE threat object.
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "id",            ocsf_field: "finding_info.uid" }
  - { source_path: "slug",          ocsf_field: "finding_info.title" }
  - { source_path: "creation_date", ocsf_field: "finding_info.created_time" }
  - { source_path: "first_seen",    ocsf_field: "finding_info.first_seen_time" }
  - { source_path: "last_seen",     ocsf_field: "finding_info.last_seen_time" }
  - { source_path: "last_update",   ocsf_field: "finding_info.modified_time" }
  - { source_path: "status",        ocsf_field: "status" }
  # ── MITRE ATT&CK (native mitre_tactics list) ──────────────────────
  - { source_path: "mitre_tactics[0]", ocsf_field: "attacks.tactic.name" }
  # ── Top impacted endpoint / user / rule (native aggregates) ───────
  - { source_path: "top_agents[0].agent_hostname",   ocsf_field: "src_endpoint.hostname" }
  - { source_path: "top_impacted_users[0].user_name", ocsf_field: "user.name" }
  - { source_path: "top_rules[0].rule_name",         ocsf_field: "rule.name" }