name: "Recorded Future Alerts → OCSF"
description: "Maps a Recorded Future alert (/v2/alert/search, results_path = data.results) to OCSF Detection Finding fields. Alerts are generated by alerting rules over Recorded Future intelligence."
field_mappings:
  title: "title"
# results_path = data.results; source_path is JSONata over ONE alert object.
# Paths absent from a given alert return nothing and are skipped.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "id",             ocsf_field: "finding_info.uid" }
  - { source_path: "title",          ocsf_field: "finding_info.title" }
  - { source_path: "triggered",      ocsf_field: "finding_info.created_time" }
  - { source_path: "url",            ocsf_field: "finding_info.src_url" }
  # ── Triggering rule (analytic) ────────────────────────────────────
  - { source_path: "rule.name",      ocsf_field: "finding_info.analytic.name" }
  - { source_path: "rule.id",        ocsf_field: "finding_info.analytic.uid" }
  # ── Incident state ────────────────────────────────────────────────
  - { source_path: "review.status",  ocsf_field: "status" }
  - { source_path: "type",           ocsf_field: "activity_name" }
  - { source_path: "review.assignee", ocsf_field: "assignee.name" }