name: "SentinelOne Threats → OCSF"
description: "Maps a SentinelOne v2.1 threat object (data[]) to OCSF endpoint/file/process fields."
field_mappings:
  title: "threatInfo.threatName"
  severity: "threatInfo.confidenceLevel = 'malicious' ? 4 : 3"
  description: "threatInfo.classification"
ocsf:
  - { source_path: "agentRealtimeInfo.agentComputerName", ocsf_field: "src_endpoint.hostname" }
  - { source_path: "agentDetectionInfo.externalIp",        ocsf_field: "src_endpoint.ip" }
  - { source_path: "agentDetectionInfo.agentOsName",       ocsf_field: "src_endpoint.os.name" }
  - { source_path: "threatInfo.sha256",                    ocsf_field: "file.hashes.sha256" }
  - { source_path: "threatInfo.filePath",                  ocsf_field: "file.path" }
  - { source_path: "threatInfo.maliciousProcessArguments", ocsf_field: "process.cmd_line" }