name: "Microsoft Defender Alerts → OCSF"
description: "Maps a Defender for Endpoint alert (get_incidents, results_path = result) to OCSF finding fields. Uses the first evidence entry for host/user/file where present."
field_mappings:
  title: "title"
  severity: "severity = 'High' ? 4 : (severity = 'Medium' ? 3 : (severity = 'Low' ? 2 : 1))"
  description: "description"
ocsf:
  - { source_path: "id",                   ocsf_field: "finding_info.uid" }
  - { source_path: "title",                ocsf_field: "finding_info.title" }
  - { source_path: "description",          ocsf_field: "finding_info.desc" }
  - { source_path: "category",             ocsf_field: "finding_info.analytic.category" }
  - { source_path: "alertCreationTime",    ocsf_field: "finding_info.created_time" }
  - { source_path: "lastUpdateTime",       ocsf_field: "finding_info.modified_time" }
  - { source_path: "status",               ocsf_field: "status" }
  - { source_path: "determination",        ocsf_field: "disposition" }
  - { source_path: "detectionSource",      ocsf_field: "finding_info.analytic.name" }
  - { source_path: "threatFamilyName",     ocsf_field: "malware.name" }
  - { source_path: "computerDnsName",      ocsf_field: "device.hostname" }
  - { source_path: "machineId",            ocsf_field: "device.uid" }
  - { source_path: "assignedTo",           ocsf_field: "assignee.name" }
  - { source_path: "mitreTechniques[0]",   ocsf_field: "attacks.technique.uid" }