name: "Microsoft Sentinel Incidents → OCSF"
description: "Maps a Sentinel incident (get_incidents, results_path = result) to OCSF finding fields. The fetch script lifts the ARM 'properties' object to the top level and keeps the incident 'name' (GUID) as the id."
field_mappings:
  title: "title"
  severity: "severity = 'High' ? 4 : (severity = 'Medium' ? 3 : (severity = 'Low' ? 2 : 1))"
  description: "description"
ocsf:
  - { source_path: "name",              ocsf_field: "finding_info.uid" }
  - { source_path: "incidentNumber",    ocsf_field: "finding_info.uid_alt" }
  - { source_path: "title",             ocsf_field: "finding_info.title" }
  - { source_path: "description",       ocsf_field: "finding_info.desc" }
  - { source_path: "createdTimeUtc",    ocsf_field: "finding_info.created_time" }
  - { source_path: "lastModifiedTimeUtc", ocsf_field: "finding_info.modified_time" }
  - { source_path: "incidentUrl",       ocsf_field: "finding_info.src_url" }
  - { source_path: "status",            ocsf_field: "status" }
  - { source_path: "classification",    ocsf_field: "disposition" }
  - { source_path: "owner.assignedTo",  ocsf_field: "assignee.name" }
  - { source_path: "labels[0].labelName", ocsf_field: "finding_info.types" }