name: "Rapid7 InsightIDR Investigations → OCSF"
description: "Maps a Rapid7 InsightIDR investigation (idr/v2/investigations, results_path = data) to OCSF Incident Finding fields. Investigations aggregate the applicable alert data; use list_investigation_alerts for per-alert detail. v1 (id) and v2 (rrn) shapes are both covered via fallbacks."
field_mappings:
  title: "title"
  # toSeverity maps CRITICAL→5, HIGH→3, MEDIUM→2, LOW→1; UNSPECIFIED falls back to the rule default.
  severity: "priority"
  # How the investigation was generated (USER / ALERT).
  source: "source"
# results_path = data; source_path is JSONata over ONE investigation object.
# Paths absent from a given investigation return nothing and are skipped, so v1/v2 fallbacks are safe.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "rrn ? rrn : id",                                     ocsf_field: "finding_info.uid" }
  - { source_path: "title",                                              ocsf_field: "finding_info.title" }
  - { source_path: "created_time",                                       ocsf_field: "finding_info.created_time" }
  - { source_path: "last_accessed",                                      ocsf_field: "finding_info.modified_time" }
  - { source_path: "first_alert_time ? first_alert_time : alert.first_event_time", ocsf_field: "finding_info.first_seen_time" }
  - { source_path: "latest_alert_time",                                  ocsf_field: "finding_info.last_seen_time" }
  - { source_path: "tags",                                               ocsf_field: "metadata.labels" }
  # ── Incident state ────────────────────────────────────────────────
  - { source_path: "status",                                             ocsf_field: "status" }
  - { source_path: "priority",                                           ocsf_field: "priority" }
  - { source_path: "disposition",                                        ocsf_field: "disposition" }
  - { source_path: "source",                                             ocsf_field: "activity_name" }
  - { source_path: "responsibility",                                     ocsf_field: "comment" }
  # ── Assignee (User) ───────────────────────────────────────────────
  - { source_path: "assignee.name ? assignee.name : assignee_name",      ocsf_field: "assignee.name" }
  - { source_path: "assignee.email ? assignee.email : assignee_email",   ocsf_field: "assignee.email_addr" }
  # ── Owning organization ───────────────────────────────────────────
  - { source_path: "organization_id",                                    ocsf_field: "cloud.org.uid" }
  # ── Originating alert (v1 shape) ──────────────────────────────────
  - { source_path: "alert.type",                                         ocsf_field: "finding_info.analytic.name" }
  - { source_path: "alert.type_description",                             ocsf_field: "finding_info.analytic.desc" }