Guillaume BOURGEOIS
84be770928
Gmail for one mailbox over OAuth 2.0 (no service account / delegation): auth-link + exchange-code to obtain a refresh token, connectivity test, message search/get, send/reply with attachments, attachment retrieval, and get_incidents ingestion with an OCSF mapper. Refresh-token grant, stdlib-only (no extra Python dependencies). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
16 lines
845 B
YAML
16 lines
845 B
YAML
name: "Gmail Single User Messages → OCSF"
|
|
description: "Maps a Gmail message (get_incidents, results_path = result) to OCSF finding fields. Messages are flattened by the fetch script (subject/from/to/date extracted from headers)."
|
|
field_mappings:
|
|
title: "subject"
|
|
severity: "2"
|
|
description: "snippet"
|
|
ocsf:
|
|
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "thread_id", ocsf_field: "finding_info.uid_alt" }
|
|
- { source_path: "subject", ocsf_field: "finding_info.title" }
|
|
- { source_path: "snippet", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "date", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "labels", ocsf_field: "finding_info.types" }
|
|
- { source_path: "from", ocsf_field: "actor.user.name" }
|
|
- { source_path: "to", ocsf_field: "user.name" }
|