name: "CrowdStrike Falcon Alerts → OCSF"
description: "Exhaustive map of a CrowdStrike Falcon unified alert (alerts/entities/alerts/v2, results_path = resources) to OCSF. Field paths validated against the Falcon Raptor alert schema. Triggering process = actor (actor.*); detected file = subject (file.*); MITRE under attacks.*."
field_mappings:
  title: "name"
  # A plain path, not a ternary: the ingestion engine reads the words
  # informational/low/medium/high/critical natively, so Falcon's severity_name
  # needs no translation. This was a four-branch ternary that resolved to nothing
  # and left every alert on the rule's default severity, whatever Falcon said.
  severity: "severity_name"
  description: "description"
# results_path = resources; source_path is JSONata over ONE alert object.
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
ocsf:
  # ── Endpoint / device ─────────────────────────────────────────────
  - { source_path: "device.hostname",        ocsf_field: "src_endpoint.hostname" }
  - { source_path: "device.hostinfo.domain", ocsf_field: "src_endpoint.domain" }
  - { source_path: "device.external_ip",     ocsf_field: "src_endpoint.ip" }
  - { source_path: "device.local_ip",        ocsf_field: "device.ip" }
  - { source_path: "device.os_version",      ocsf_field: "src_endpoint.os.name" }
  - { source_path: "device.platform_name",   ocsf_field: "src_endpoint.os.type" }
  - { source_path: "device.mac_address",     ocsf_field: "src_endpoint.mac" }
  - { source_path: "device.device_id",       ocsf_field: "device.uid" }
  - { source_path: "device.agent_version",   ocsf_field: "metadata.product.version" }
  - { source_path: "device.cid",             ocsf_field: "cloud.account.uid" }
  # ── Finding / analytic ────────────────────────────────────────────
  - { source_path: "composite_id",       ocsf_field: "finding_info.uid" }
  - { source_path: "name",               ocsf_field: "finding_info.title" }
  - { source_path: "description",        ocsf_field: "finding_info.desc" }
  - { source_path: "created_timestamp",  ocsf_field: "finding_info.created_time" }
  # `time` is the OCSF event time: when Falcon raised the alert.
  # Riposte no longer reads it to date detection (MTTD retired, migration 0256):
  # it is the alert's own record of when the source saw the event.
  - { source_path: "created_timestamp",  ocsf_field: "time" }
  - { source_path: "updated_timestamp",  ocsf_field: "finding_info.modified_time" }
  - { source_path: "scenario",           ocsf_field: "finding_info.analytic.name" }
  - { source_path: "pattern_id",         ocsf_field: "finding_info.analytic.uid" }
  - { source_path: "confidence",         ocsf_field: "confidence" }
  - { source_path: "status",             ocsf_field: "status" }
  # ── MITRE ATT&CK ──────────────────────────────────────────────────
  - { source_path: "tactic",       ocsf_field: "attacks.tactic.name" }
  - { source_path: "tactic_id",    ocsf_field: "attacks.tactic.uid" }
  - { source_path: "technique",    ocsf_field: "attacks.technique.name" }
  - { source_path: "technique_id", ocsf_field: "attacks.technique.uid" }
  # ── Triggering process — the actor ────────────────────────────────
  - { source_path: "filename",     ocsf_field: "actor.process.name" }
  - { source_path: "cmdline",      ocsf_field: "actor.process.cmd_line" }
  - { source_path: "filepath",     ocsf_field: "actor.process.file.path" }
  - { source_path: "sha256",       ocsf_field: "actor.process.file.hashes.sha256" }
  - { source_path: "md5",          ocsf_field: "actor.process.file.hashes.md5" }
  - { source_path: "user_name",    ocsf_field: "actor.user.name" }
  - { source_path: "user_id",      ocsf_field: "actor.user.uid" }
  # ── Parent process ────────────────────────────────────────────────
  - { source_path: "parent_details.cmdline", ocsf_field: "actor.process.parent_process.cmd_line" }
  # ── Detected file — the subject ───────────────────────────────────
  - { source_path: "filename",         ocsf_field: "file.name" }
  - { source_path: "filepath",         ocsf_field: "file.path" }
  - { source_path: "sha256",           ocsf_field: "file.hashes.sha256" }
  - { source_path: "md5",              ocsf_field: "file.hashes.md5" }
  - { source_path: "alleged_filetype", ocsf_field: "file.type" }
  # ── IOC / observable ──────────────────────────────────────────────
  - { source_path: "ioc_value", ocsf_field: "observables.value" }
  - { source_path: "ioc_type",  ocsf_field: "observables.type" }