name: "SentinelOne Alerts → OCSF"
description: "Maps a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF endpoint/file/process fields."
field_mappings:
  title: "ruleInfo.name"
  severity: "ruleInfo.severity = 'Critical' ? 5 : (ruleInfo.severity = 'High' ? 4 : 3)"
  description: "alertInfo.eventType"
ocsf:
  - { source_path: "agentDetectionInfo.name",          ocsf_field: "src_endpoint.hostname" }
  - { source_path: "agentDetectionInfo.osName",        ocsf_field: "src_endpoint.os.name" }
  - { source_path: "sourceProcessInfo.filePath",       ocsf_field: "process.file.path" }
  - { source_path: "sourceProcessInfo.commandline",    ocsf_field: "process.cmd_line" }
  - { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "file.hashes.sha256" }