name: "ServiceNow Tickets → OCSF"
description: "Maps a ServiceNow ticket (Table API, results_path = result) to OCSF finding fields. Reference fields (assigned_to, caller_id, cmdb_ci, …) are {value, link} objects in raw mode and {value, display_value} objects when the fetch uses sysparm_display_value=all — both path variants are listed and absent ones are skipped safely."
field_mappings:
  title: "short_description"
  severity: "priority = '1' ? 5 : (priority = '2' ? 4 : (priority = '3' ? 3 : 2))"
  description: "description"
# results_path = result; source_path is JSONata over ONE ticket object.
# Paths absent from a given ticket are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "sys_id",            ocsf_field: "finding_info.uid" }
  - { source_path: "number",            ocsf_field: "finding_info.uid_alt" }
  - { source_path: "short_description", ocsf_field: "finding_info.title" }
  - { source_path: "description",       ocsf_field: "finding_info.desc" }
  - { source_path: "opened_at",         ocsf_field: "finding_info.first_seen_time" }
  - { source_path: "sys_created_on",    ocsf_field: "finding_info.created_time" }
  - { source_path: "sys_updated_on",    ocsf_field: "finding_info.modified_time" }
  - { source_path: "category",          ocsf_field: "finding_info.analytic.category" }
  - { source_path: "subcategory",       ocsf_field: "finding_info.types" }
  - { source_path: "state",             ocsf_field: "status" }
  - { source_path: "close_code",        ocsf_field: "disposition" }
  - { source_path: "close_notes",       ocsf_field: "comment" }
  # ── People ────────────────────────────────────────────────────────
  - { source_path: "sys_created_by",              ocsf_field: "actor.user.name" }
  - { source_path: "caller_id.display_value",     ocsf_field: "user.name" }
  - { source_path: "assigned_to.display_value",   ocsf_field: "assignee.name" }
  # ── Affected CI ───────────────────────────────────────────────────
  - { source_path: "cmdb_ci.display_value",       ocsf_field: "device.hostname" }