name: "Sekoia XDR Alerts → OCSF"
description: "Maps a Sekoia Defend (XDR) alert (/v1/sic/alerts, results_path = items) to OCSF Detection Finding fields. Alerts aggregate the matching events; use search_events for per-event detail."
field_mappings:
  title: "title"
  description: "details"
  # urgency is a 0-100 score; bucket it onto the 1-5 incident scale. No parentheses (the engine chains
  # right-associatively) and the lowest band uses '>= 0 ? 1' so the literal 1 sits in a then-branch —
  # a bare trailing else is read as a field path, not an integer, and would fall back to the default.
  severity: "urgency.value >= 80 ? 5 : urgency.value >= 60 ? 4 : urgency.value >= 40 ? 3 : urgency.value >= 20 ? 2 : urgency.value >= 0 ? 1 : 1"
  # How the alert was generated.
  source: "source"
# results_path = items; source_path is JSONata over ONE alert object.
# Paths absent from a given alert return nothing and are skipped.
ocsf:
  # ── Finding ───────────────────────────────────────────────────────
  - { source_path: "uuid",            ocsf_field: "finding_info.uid" }
  - { source_path: "title",           ocsf_field: "finding_info.title" }
  - { source_path: "rule.description", ocsf_field: "finding_info.desc" }
  - { source_path: "created_at",      ocsf_field: "finding_info.created_time" }
  - { source_path: "updated_at",      ocsf_field: "finding_info.modified_time" }
  - { source_path: "first_seen_at",   ocsf_field: "finding_info.first_seen_time" }
  - { source_path: "last_seen_at",    ocsf_field: "finding_info.last_seen_time" }
  # ── Detection rule (analytic) ─────────────────────────────────────
  - { source_path: "rule.name",        ocsf_field: "finding_info.analytic.name" }
  - { source_path: "rule.uuid",        ocsf_field: "finding_info.analytic.uid" }
  - { source_path: "rule.description", ocsf_field: "finding_info.analytic.desc" }
  - { source_path: "rule.type",        ocsf_field: "finding_info.analytic.type" }
  # ── Incident state ────────────────────────────────────────────────
  - { source_path: "status.name",      ocsf_field: "status" }
  - { source_path: "alert_type.value", ocsf_field: "activity_name" }
  - { source_path: "similar",          ocsf_field: "count" }
  - { source_path: "urgency.value",    ocsf_field: "risk_score" }
  # ── MITRE ATT&CK (first TTP / kill-chain step) ────────────────────
  - { source_path: "ttps[0].name",         ocsf_field: "attacks.technique.name" }
  - { source_path: "ttps[0].id",           ocsf_field: "attacks.technique.uid" }
  - { source_path: "kill_chain_short_id",  ocsf_field: "attacks.tactic.uid" }
  # ── Target host ───────────────────────────────────────────────────
  - { source_path: "target",          ocsf_field: "src_endpoint.hostname" }
  # ── Owning entity / tenant ────────────────────────────────────────
  - { source_path: "entity.name",     ocsf_field: "cloud.org.name" }
  - { source_path: "entity.uuid",     ocsf_field: "cloud.org.uid" }
  - { source_path: "short_id",        ocsf_field: "metadata.uid" }
  - { source_path: "community_uuid",  ocsf_field: "metadata.tenant_uid" }