Guillaume BOURGEOIS
811a85424b
22 commands (Security Center API): alert ingestion + triage, machine isolate/unisolate, restrict/unrestrict app execution, AV scan, stop & quarantine file, collect investigation package, offboard, tag, list machine actions, advanced hunting (KQL), and custom indicators. Azure AD OAuth 2.0 client-credentials, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
22 lines
1.4 KiB
YAML
22 lines
1.4 KiB
YAML
name: "Microsoft Defender Alerts → OCSF"
|
|
description: "Maps a Defender for Endpoint alert (get_incidents, results_path = result) to OCSF finding fields. Uses the first evidence entry for host/user/file where present."
|
|
field_mappings:
|
|
title: "title"
|
|
severity: "severity = 'High' ? 4 : (severity = 'Medium' ? 3 : (severity = 'Low' ? 2 : 1))"
|
|
description: "description"
|
|
ocsf:
|
|
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "title", ocsf_field: "finding_info.title" }
|
|
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "category", ocsf_field: "finding_info.analytic.category" }
|
|
- { source_path: "alertCreationTime", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "lastUpdateTime", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
- { source_path: "determination", ocsf_field: "disposition" }
|
|
- { source_path: "detectionSource", ocsf_field: "finding_info.analytic.name" }
|
|
- { source_path: "threatFamilyName", ocsf_field: "malware.name" }
|
|
- { source_path: "computerDnsName", ocsf_field: "device.hostname" }
|
|
- { source_path: "machineId", ocsf_field: "device.uid" }
|
|
- { source_path: "assignedTo", ocsf_field: "assignee.name" }
|
|
- { source_path: "mitreTechniques[0]", ocsf_field: "attacks.technique.uid" }
|