name: "Cisco Secure Endpoint Events → OCSF"
description: "Maps a Cisco AMP for Endpoints event object (GET /v1/events, results_path = data) to OCSF. The detected file is the subject (file.*/malware.*); the process that dropped/ran it (file.parent.*) is the actor (actor.process.*). Field paths validated against the AMP API v1 event schema (Cisco docs + demisto/content CiscoAMP pack README)."
field_mappings:
  title: "detection ? detection : event_type"
  severity: "severity = 'Critical' ? 5 : (severity = 'High' ? 4 : (severity = 'Medium' ? 3 : 2))"
  description: "event_type"
# results_path = data; source_path is JSONata over ONE event object.
# Paths absent from a given event are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Endpoint / device ──────────────────────────────────────────────
  - { source_path: "computer.hostname",       ocsf_field: "src_endpoint.hostname" }
  - { source_path: "computer.external_ip",    ocsf_field: "src_endpoint.ip" }
  - { source_path: "computer.connector_guid", ocsf_field: "device.uid" }
  - { source_path: "computer.user",           ocsf_field: "user.name" }
  # ── Finding / analytic ─────────────────────────────────────────────
  - { source_path: "id",            ocsf_field: "finding_info.uid" }
  - { source_path: "timestamp",     ocsf_field: "finding_info.created_time" }
  - { source_path: "event_type",    ocsf_field: "finding_info.analytic.name" }
  - { source_path: "event_type_id", ocsf_field: "finding_info.analytic.uid" }
  - { source_path: "file.disposition", ocsf_field: "disposition" }
  # ── Malware / detection ────────────────────────────────────────────
  - { source_path: "detection",    ocsf_field: "malware.name" }
  - { source_path: "detection_id", ocsf_field: "malware.uid" }
  # ── Detected file — the subject ────────────────────────────────────
  - { source_path: "file.file_name",       ocsf_field: "file.name" }
  - { source_path: "file.file_path",       ocsf_field: "file.path" }
  - { source_path: "file.identity.sha256", ocsf_field: "file.hashes.sha256" }
  - { source_path: "file.identity.sha1",   ocsf_field: "file.hashes.sha1" }
  - { source_path: "file.identity.md5",    ocsf_field: "file.hashes.md5" }
  # ── Parent process (dropped/ran the file) — the actor ──────────────
  - { source_path: "file.parent.file_name",       ocsf_field: "actor.process.name" }
  - { source_path: "file.parent.process_id",      ocsf_field: "actor.process.pid" }
  - { source_path: "file.parent.identity.sha256", ocsf_field: "actor.process.file.hashes.sha256" }
  - { source_path: "file.parent.identity.sha1",   ocsf_field: "actor.process.file.hashes.sha1" }
  - { source_path: "file.parent.identity.md5",    ocsf_field: "actor.process.file.hashes.md5" }