name: "OpenCTI Incidents → OCSF"
description: "Maps an OpenCTI incident (get_incidents, results_path = entities) to OCSF finding fields. Each entity is a normalized incident object emitted by the get_incidents script."
field_mappings:
  title: "name"
  severity: "severity = 'critical' ? 5 : (severity = 'high' ? 4 : (severity = 'medium' ? 3 : 2))"
  description: "description"
# results_path = entities; source_path is JSONata over ONE incident object.
# Paths absent from a given incident are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "id",            ocsf_field: "finding_info.uid" }
  - { source_path: "name",          ocsf_field: "finding_info.title" }
  - { source_path: "description",   ocsf_field: "finding_info.desc" }
  - { source_path: "created",       ocsf_field: "finding_info.created_time" }
  - { source_path: "updatedAt",     ocsf_field: "finding_info.modified_time" }
  - { source_path: "incidentTypes", ocsf_field: "finding_info.types" }
  - { source_path: "objective",     ocsf_field: "message" }
  - { source_path: "confidence",    ocsf_field: "confidence_score" }