Guillaume BOURGEOIS
fcf516ca82
Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/ file/cve risk reputation, full entity intelligence, and alert ingestion (alerts search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus alert lookup and alert-rule search. Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails API, APIKEY header, project-scoped). Project issue ingestion (project_issues) with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by a configurable minimum severity, plus recent-issues and recent-issues-by-host queries. The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
1.5 KiB
YAML
20 lines
1.5 KiB
YAML
name: "Recorded Future Alerts → OCSF"
|
|
description: "Maps a Recorded Future alert (/v2/alert/search, results_path = data.results) to OCSF Detection Finding fields. Alerts are generated by alerting rules over Recorded Future intelligence."
|
|
field_mappings:
|
|
title: "title"
|
|
# results_path = data.results; source_path is JSONata over ONE alert object.
|
|
# Paths absent from a given alert return nothing and are skipped.
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "title", ocsf_field: "finding_info.title" }
|
|
- { source_path: "triggered", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "url", ocsf_field: "finding_info.src_url" }
|
|
# ── Triggering rule (analytic) ────────────────────────────────────
|
|
- { source_path: "rule.name", ocsf_field: "finding_info.analytic.name" }
|
|
- { source_path: "rule.id", ocsf_field: "finding_info.analytic.uid" }
|
|
# ── Incident state ────────────────────────────────────────────────
|
|
- { source_path: "review.status", ocsf_field: "status" }
|
|
- { source_path: "type", ocsf_field: "activity_name" }
|
|
- { source_path: "review.assignee", ocsf_field: "assignee.name" }
|