name: "SentinelOne Alerts → OCSF"
description: "Maps a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF endpoint/file/process/rule fields."
field_mappings:
  title: "ruleInfo.name"
  severity: "ruleInfo.severity = 'Critical' ? 5 : (ruleInfo.severity = 'High' ? 4 : 3)"
  description: "alertInfo.eventType"
# source_path is evaluated against ONE alert object (alert rule results_path = data).
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
ocsf:
  # Endpoint
  - { source_path: "agentDetectionInfo.name",          ocsf_field: "src_endpoint.hostname" }
  - { source_path: "agentDetectionInfo.osName",        ocsf_field: "src_endpoint.os.name" }
  - { source_path: "agentDetectionInfo.osRevision",    ocsf_field: "device.os.build" }
  - { source_path: "agentDetectionInfo.uuid",          ocsf_field: "device.uid" }
  # Rule / finding
  - { source_path: "ruleInfo.name",                    ocsf_field: "rule.name" }
  - { source_path: "ruleInfo.id",                      ocsf_field: "rule.uid" }
  - { source_path: "ruleInfo.description",             ocsf_field: "rule.desc" }
  - { source_path: "alertInfo.alertId",                ocsf_field: "finding_info.uid" }
  - { source_path: "alertInfo.dvEventId",              ocsf_field: "metadata.original_event_uid" }
  # Source process
  - { source_path: "sourceProcessInfo.name",           ocsf_field: "process.name" }
  - { source_path: "sourceProcessInfo.pid",            ocsf_field: "process.pid" }
  - { source_path: "sourceProcessInfo.filePath",       ocsf_field: "process.file.path" }
  - { source_path: "sourceProcessInfo.commandline",    ocsf_field: "process.cmd_line" }
  - { source_path: "sourceProcessInfo.user",           ocsf_field: "process.user.name" }
  - { source_path: "sourceProcessInfo.integrityLevel", ocsf_field: "process.integrity" }
  - { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "file.hashes.sha256" }
  - { source_path: "sourceProcessInfo.fileHashSha1",   ocsf_field: "file.hashes.sha1" }
  - { source_path: "sourceProcessInfo.fileHashMd5",    ocsf_field: "file.hashes.md5" }
  # Parent process
  - { source_path: "sourceParentProcessInfo.name",        ocsf_field: "process.parent_process.name" }
  - { source_path: "sourceParentProcessInfo.pid",         ocsf_field: "process.parent_process.pid" }
  - { source_path: "sourceParentProcessInfo.commandline", ocsf_field: "process.parent_process.cmd_line" }