name: "SentinelOne SDL Alerts → OCSF"
description: "Maps a SentinelOne SDL Unified Alert (GraphQL alerts query, results_path = data — edges flattened to nodes) to OCSF Detection Finding fields."
field_mappings:
  title: "name"
  description: "description"
  # toSeverity maps CRITICAL→5, HIGH→3, MEDIUM→2, LOW→1, INFO→1.
  severity: "severity"
  source: "detectionSource.vendor"
# results_path = data; source_path is JSONata over ONE alert node.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "id",            ocsf_field: "finding_info.uid" }
  - { source_path: "name",          ocsf_field: "finding_info.title" }
  - { source_path: "description",   ocsf_field: "finding_info.desc" }
  - { source_path: "detectedAt",    ocsf_field: "finding_info.created_time" }
  - { source_path: "updatedAt",     ocsf_field: "finding_info.modified_time" }
  - { source_path: "firstSeenAt",   ocsf_field: "finding_info.first_seen_time" }
  - { source_path: "lastSeenAt",    ocsf_field: "finding_info.last_seen_time" }
  - { source_path: "externalId",    ocsf_field: "finding_info.uid_alt" }
  # ── Incident state ────────────────────────────────────────────────
  - { source_path: "status",         ocsf_field: "status" }
  - { source_path: "analystVerdict", ocsf_field: "disposition" }
  - { source_path: "classification", ocsf_field: "activity_name" }
  - { source_path: "confidenceLevel", ocsf_field: "confidence" }
  - { source_path: "attackSurfaces[0]", ocsf_field: "metadata.labels" }
  # ── Detection analytic ────────────────────────────────────────────
  - { source_path: "analytics.name",          ocsf_field: "finding_info.analytic.name" }
  - { source_path: "analytics.uid",           ocsf_field: "finding_info.analytic.uid" }
  - { source_path: "analytics.category",      ocsf_field: "finding_info.analytic.category" }
  - { source_path: "detectionSource.vendor",  ocsf_field: "metadata.product.vendor_name" }
  - { source_path: "detectionSource.product", ocsf_field: "metadata.product.name" }
  - { source_path: "detectionSource.engine",  ocsf_field: "metadata.product.feature.name" }
  # ── Affected device ───────────────────────────────────────────────
  - { source_path: "asset.name",       ocsf_field: "device.hostname" }
  - { source_path: "asset.id",         ocsf_field: "device.uid" }
  - { source_path: "asset.osType",     ocsf_field: "device.os.type" }
  - { source_path: "asset.osVersion",  ocsf_field: "device.os.build" }
  - { source_path: "asset.agentVersion", ocsf_field: "device.agent.version" }
  - { source_path: "asset.name",       ocsf_field: "src_endpoint.hostname" }
  - { source_path: "asset.lastLoggedInUser", ocsf_field: "user.name" }
  # ── Offending process (actor) ─────────────────────────────────────
  - { source_path: "process.cmdLine",       ocsf_field: "actor.process.cmd_line" }
  - { source_path: "process.parentName",    ocsf_field: "actor.process.parent_process.name" }
  - { source_path: "process.username",      ocsf_field: "actor.user.name" }
  - { source_path: "process.file.name",     ocsf_field: "actor.process.file.name" }
  - { source_path: "process.file.path",     ocsf_field: "actor.process.file.path" }
  - { source_path: "process.file.md5",      ocsf_field: "actor.process.file.hashes.md5" }
  - { source_path: "process.file.sha1",     ocsf_field: "actor.process.file.hashes.sha1" }
  - { source_path: "process.file.sha256",   ocsf_field: "actor.process.file.hashes.sha256" }
  # ── Assignee ──────────────────────────────────────────────────────
  - { source_path: "assignee.fullName", ocsf_field: "assignee.name" }
  - { source_path: "assignee.email",    ocsf_field: "assignee.email_addr" }