name: "HarfangLab Threats → OCSF"
description: "Maps a HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results, enriched with agents/impacted_users/rules) to OCSF."
field_mappings:
  title: "slug"
  severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
  description: "status"
# results_path = results; source_path is JSONata over ONE threat object.
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "id",            ocsf_field: "finding_info.uid" }
  - { source_path: "slug",          ocsf_field: "finding_info.title" }
  - { source_path: "creation_date", ocsf_field: "finding_info.created_time" }
  - { source_path: "first_seen",    ocsf_field: "finding_info.first_seen_time" }
  - { source_path: "last_seen",     ocsf_field: "finding_info.last_seen_time" }
  - { source_path: "last_update",   ocsf_field: "finding_info.modified_time" }
  - { source_path: "status",        ocsf_field: "status" }
  # ── Impacted endpoint (first enriched agent) ──────────────────────
  - { source_path: "agents[0].hostname",      ocsf_field: "src_endpoint.hostname" }
  - { source_path: "agents[0].domainname",    ocsf_field: "src_endpoint.domain" }
  - { source_path: "agents[0].osproducttype", ocsf_field: "src_endpoint.os.name" }
  - { source_path: "agents[0].ostype",        ocsf_field: "src_endpoint.os.type" }
  # ── Impacted user / rule ──────────────────────────────────────────
  - { source_path: "impacted_users[0].full_name", ocsf_field: "user.name" }
  - { source_path: "rules[0].rule_name",          ocsf_field: "rule.name" }