Guillaume BOURGEOIS
b99de4af19
The mock now emits incidents already in an OCSF-aligned shape (src_endpoint, device, user, rule, dst_endpoint, dns_query, cloud, metadata). Map those nested fields through to OCSF instead of only the flat OpenAPI fields. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
48 lines
3.8 KiB
YAML
48 lines
3.8 KiB
YAML
name: "Mock EDR Incidents → OCSF"
|
|
description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields. Events already arrive in an OCSF-aligned shape, so most paths map through directly."
|
|
field_mappings:
|
|
title: "title"
|
|
description: "description"
|
|
source: "source"
|
|
# toSeverity maps critical→5, high→3, medium→2, low→1, informational→1.
|
|
severity: "severity"
|
|
# results_path = items; source_path is JSONata over ONE incident object.
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "external_id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "title", ocsf_field: "finding_info.title" }
|
|
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "created_at", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "updated_at", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
# ── Detection rule (analytic) ─────────────────────────────────────
|
|
- { source_path: "rule.name", ocsf_field: "finding_info.analytic.name" }
|
|
- { source_path: "rule.uid", ocsf_field: "finding_info.analytic.uid" }
|
|
- { source_path: "rule.desc", ocsf_field: "finding_info.analytic.desc" }
|
|
# ── Affected host (source endpoint / device) ──────────────────────
|
|
- { source_path: "src_endpoint.hostname", ocsf_field: "src_endpoint.hostname" }
|
|
- { source_path: "src_endpoint.ip", ocsf_field: "src_endpoint.ip" }
|
|
- { source_path: "src_endpoint.os.name", ocsf_field: "src_endpoint.os.name" }
|
|
- { source_path: "src_endpoint.os.type", ocsf_field: "src_endpoint.os.type" }
|
|
- { source_path: "src_endpoint.hostname", ocsf_field: "device.hostname" }
|
|
- { source_path: "device.uid", ocsf_field: "device.uid" }
|
|
- { source_path: "device.type", ocsf_field: "device.type" }
|
|
- { source_path: "device.os.build", ocsf_field: "device.os.build" }
|
|
- { source_path: "src_endpoint.os.name", ocsf_field: "device.os.name" }
|
|
# ── Network (destination / connection / DNS) ──────────────────────
|
|
- { source_path: "dst_endpoint.ip", ocsf_field: "dst_endpoint.ip" }
|
|
- { source_path: "dst_endpoint.port", ocsf_field: "dst_endpoint.port" }
|
|
- { source_path: "connection_info.direction", ocsf_field: "connection_info.direction" }
|
|
- { source_path: "dns_query.hostname", ocsf_field: "dns_query.hostname" }
|
|
# ── User ──────────────────────────────────────────────────────────
|
|
- { source_path: "user.name", ocsf_field: "user.name" }
|
|
- { source_path: "user.domain", ocsf_field: "user.domain" }
|
|
- { source_path: "user.uid", ocsf_field: "user.uid" }
|
|
# ── File artefact ─────────────────────────────────────────────────
|
|
- { source_path: "file_path", ocsf_field: "file.path" }
|
|
# ── Cloud / metadata ──────────────────────────────────────────────
|
|
- { source_path: "cloud.account.uid", ocsf_field: "cloud.account.uid" }
|
|
- { source_path: "metadata.original_event_uid", ocsf_field: "metadata.uid" }
|
|
- { source_path: "source", ocsf_field: "metadata.product.name" }
|
|
- { source_path: "metadata.product.version", ocsf_field: "metadata.product.version" }
|