name: "HarfangLab Security Events → OCSF"
description: "Maps a HarfangLab EDR security event/alert (/api/data/alert/alert/Alert/, results_path = results) to OCSF. The matched process is the actor (actor.*). Process fields are best-effort; confirm against a live sample via the builder Test."
field_mappings:
  title: "rule_name"
  severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
  description: "alert_type"
# results_path = results; source_path is JSONata over ONE alert object.
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Endpoint ──────────────────────────────────────────────────────
  - { source_path: "agent.hostname",       ocsf_field: "src_endpoint.hostname" }
  - { source_path: "agent.domainname",     ocsf_field: "src_endpoint.domain" }
  - { source_path: "agent.osproducttype",  ocsf_field: "src_endpoint.os.name" }
  - { source_path: "agent.ostype",         ocsf_field: "src_endpoint.os.type" }
  - { source_path: "agent.agentid",        ocsf_field: "device.uid" }
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "id",          ocsf_field: "finding_info.uid" }
  - { source_path: "rule_name",   ocsf_field: "finding_info.title" }
  - { source_path: "alert_time",  ocsf_field: "finding_info.created_time" }
  - { source_path: "last_update", ocsf_field: "finding_info.modified_time" }
  - { source_path: "alert_type",  ocsf_field: "finding_info.analytic.type" }
  - { source_path: "status",      ocsf_field: "status" }
  - { source_path: "maturity",    ocsf_field: "status_detail" }
  # ── Matched process — the actor ───────────────────────────────────
  - { source_path: "process.process_name",      ocsf_field: "actor.process.name" }
  - { source_path: "process.image_name",        ocsf_field: "actor.process.file.path" }
  - { source_path: "process.commandline",       ocsf_field: "actor.process.cmd_line" }
  - { source_path: "process.username",          ocsf_field: "actor.user.name" }
  - { source_path: "process.integrity_level",   ocsf_field: "actor.process.integrity" }
  - { source_path: "process.pid",               ocsf_field: "actor.process.pid" }
  - { source_path: "process.hashes.sha256",     ocsf_field: "actor.process.file.hashes.sha256" }
  - { source_path: "process.hashes.sha1",       ocsf_field: "actor.process.file.hashes.sha1" }
  - { source_path: "process.hashes.md5",        ocsf_field: "actor.process.file.hashes.md5" }
  - { source_path: "process.parent_image",      ocsf_field: "actor.process.parent_process.name" }
  - { source_path: "process.parent_commandline", ocsf_field: "actor.process.parent_process.cmd_line" }