Guillaume BOURGEOIS
27615636e3
Gmail API + Directory API (27 commands): mailbox search/read/send/ trash/label/move, attachments retrieval, vacation auto-reply, filters, forwarding addresses, delegates, and Workspace user administration; message ingestion (get_incidents) with a bundled OCSF mapper. Service-account auth with domain-wide delegation (JWT RS256), runs on a remote engine (requires PyJWT + cryptography). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
16 lines
897 B
YAML
16 lines
897 B
YAML
name: "Gmail Messages → OCSF"
|
|
description: "Maps a Gmail message (get_incidents, results_path = result) to OCSF finding fields. Messages are flattened by the fetch script (subject/from/to/date extracted from headers)."
|
|
field_mappings:
|
|
title: "subject"
|
|
severity: "2"
|
|
description: "snippet"
|
|
ocsf:
|
|
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "thread_id", ocsf_field: "finding_info.uid_alt" }
|
|
- { source_path: "subject", ocsf_field: "finding_info.title" }
|
|
- { source_path: "snippet", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "date", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "labels", ocsf_field: "finding_info.types" }
|
|
- { source_path: "from", ocsf_field: "actor.user.name" }
|
|
- { source_path: "to", ocsf_field: "user.name" }
|