name: "Trend Micro Vision One Workbench Alerts → OCSF"
description: "Maps a Vision One Workbench alert (GET /v3.0/workbench/alerts, results_path = items) to OCSF finding fields. Field names verified against the v3.0 Workbench alert schema (demisto/content TrendMicroVisionOneV3 + trendmicro/tm-v1-api-cookbook). Vision One severity is a string (critical/high/medium/low/info); impactScope entities are typed (host/account/emailAddress/…) — first host → src_endpoint, first account → user."
field_mappings:
  title: "model"
  severity: "severity = 'critical' ? 5 : (severity = 'high' ? 4 : (severity = 'medium' ? 3 : (severity = 'low' ? 2 : 1)))"
  description: "description"
# results_path = items; source_path is JSONata over ONE alert object.
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Finding / analytic ────────────────────────────────────────────
  - { source_path: "id",                  ocsf_field: "finding_info.uid" }
  - { source_path: "model",               ocsf_field: "finding_info.title" }
  - { source_path: "description",         ocsf_field: "finding_info.desc" }
  - { source_path: "createdDateTime",     ocsf_field: "finding_info.created_time" }
  - { source_path: "updatedDateTime",     ocsf_field: "finding_info.modified_time" }
  - { source_path: "workbenchLink",       ocsf_field: "finding_info.src_url" }
  - { source_path: "score",               ocsf_field: "confidence_score" }
  - { source_path: "investigationStatus", ocsf_field: "status" }
  # ── Detection model as the rule ───────────────────────────────────
  - { source_path: "model",   ocsf_field: "rule.name" }
  - { source_path: "modelId", ocsf_field: "rule.uid" }
  # ── MITRE ATT&CK (nested under matchedRules[].matchedFilters[]) ────
  - { source_path: "matchedRules[0].matchedFilters[0].mitreTechniqueIds[0]", ocsf_field: "attacks.technique.uid" }
  # ── Impacted host — first 'host' entity → src_endpoint / device ────
  - { source_path: "impactScope.entities[entityType='host'][0].entityValue.name",   ocsf_field: "src_endpoint.hostname" }
  - { source_path: "impactScope.entities[entityType='host'][0].entityValue.ips[0]", ocsf_field: "src_endpoint.ip" }
  - { source_path: "impactScope.entities[entityType='host'][0].entityValue.guid",   ocsf_field: "device.uid" }
  # ── Impacted account — first 'account' entity → user ──────────────
  - { source_path: "impactScope.entities[entityType='account'][0].entityValue", ocsf_field: "user.name" }
  # ── IOC / observable (first indicator) ────────────────────────────
  - { source_path: "indicators[0].value", ocsf_field: "observables.value" }
  - { source_path: "indicators[0].type",  ocsf_field: "observables.type" }
  - { source_path: "indicators[0].field", ocsf_field: "observables.name" }
  # ── Product provenance ────────────────────────────────────────────
  - { source_path: "alertProvider", ocsf_field: "metadata.product.name" }