name: "Mock EDR Incidents → OCSF"
description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields."
field_mappings:
  title: "title"
  description: "description"
  source: "source"
  # toSeverity maps critical→5, high→3, medium→2, low→1, informational→1.
  severity: "severity"
# results_path = items; source_path is JSONata over ONE incident object.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "id",          ocsf_field: "finding_info.uid" }
  - { source_path: "external_id", ocsf_field: "metadata.uid" }
  - { source_path: "title",       ocsf_field: "finding_info.title" }
  - { source_path: "description", ocsf_field: "finding_info.desc" }
  - { source_path: "created_at",  ocsf_field: "finding_info.created_time" }
  - { source_path: "status",      ocsf_field: "status" }
  - { source_path: "source",      ocsf_field: "metadata.product.name" }
  # ── Affected host / artefact ──────────────────────────────────────
  - { source_path: "hostname",    ocsf_field: "src_endpoint.hostname" }
  - { source_path: "ip_address",  ocsf_field: "src_endpoint.ip" }
  - { source_path: "hostname",    ocsf_field: "device.hostname" }
  - { source_path: "file_path",   ocsf_field: "file.path" }