f3nris
5085d96628
fetch_rapid7_alerts opens the alert InsightIDR Essential posts as a JSON string in a single payload field (JSON or form body) and returns one flat item per relayed message; the correlation id is the dedup key. Own mapper and alert type, written from a real delivery. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xa1QDbsPTYiVREv2Cvs3Zn
60 lines
4.9 KiB
YAML
60 lines
4.9 KiB
YAML
name: "Rapid7 InsightIDR basic rule (via Webhook Relay)"
|
|
description: |
|
|
Maps one Rapid7 InsightIDR Essential basic detection rule alert, received by the
|
|
relay's Webhook notification, to an alert. fetch_rapid7_alerts has already opened
|
|
the payload (a JSON string in a `payload` field): each item carries rule,
|
|
correlation_id, event_time, log_set, log_name, hostname, log_line (log_event when
|
|
the line is JSON) and the relay's own fields (id, source, received_at, verified).
|
|
|
|
The payload has no severity and names no user or source address of its own: those
|
|
live in the log line, which Rapid7 leaves out unless the rule includes it. When it
|
|
is left out, log_line_withheld is true and the description says so — turn on the
|
|
log line in the rule's notification, or the alert only says which rule fired.
|
|
|
|
`host.name` in Rapid7's payload is the log set (Asset Authentication), not a
|
|
machine; it goes to unmapped.rapid7.log_set. device.hostname takes host.hostname,
|
|
which basic rules often leave null.
|
|
field_mappings:
|
|
title: "jsonata: rule ? rule : ('Rapid7 · ' & source)"
|
|
source: "jsonata: 'Rapid7 InsightIDR'"
|
|
description: "jsonata: decode_error ? ('Undecodable Rapid7 delivery (' & decode_error & '):\n' & $substring(body, 0, 8000)) : ('Rapid7 InsightIDR basic rule: ' & rule & '\nLog set: ' & (log_set ? log_set : '—') & ' · log: ' & (log_name ? log_name : '—') & (hostname ? '\nHost: ' & hostname : '') & (event_time ? '\nEvent time: ' & event_time : '') & '\n\n' & (log_line_withheld ? 'Log line withheld by the rule: enable it in the rule notification to see the triggering event.' : (log_line ? 'Log line:\n' & $substring(log_line, 0, 8000) : '')))"
|
|
"custom:webhook_source": "source"
|
|
"custom:webhook_verified": "jsonata: $join(verified, ',')"
|
|
"custom:webhook_message_id": "id"
|
|
"custom:webhook_received_at": "received_at"
|
|
"custom:webhook_sender_ip": "remote_ip"
|
|
"custom:webhook_payload": "jsonata: log_event ? $toTable(log_event) : rapid7 ? $toTable({'rule': rule, 'log_set': log_set, 'log': log_name, 'hostname': hostname, 'event_time': event_time, 'region': region, 'correlation_id': correlation_id}) : body"
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
# Rapid7's correlation id (falls back to relay:<message id> for an undecodable
|
|
# delivery) — also the command's dedup key.
|
|
- { source_path: "alert_id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "rule", ocsf_field: "finding_info.title" }
|
|
- { source_path: "rule", ocsf_field: "finding_info.analytic.name" }
|
|
- { source_path: "'Rule'", ocsf_field: "finding_info.analytic.type" }
|
|
- { source_path: "event_time", ocsf_field: "finding_info.created_time" }
|
|
# The time of the log event that fired the rule; receipt stays in logged_time.
|
|
- { source_path: "event_time ? event_time : received_at", ocsf_field: "time" }
|
|
- { source_path: "received_at", ocsf_field: "metadata.logged_time" }
|
|
- { source_path: "id", ocsf_field: "metadata.uid" }
|
|
- { source_path: "correlation_id", ocsf_field: "metadata.correlation_uid" }
|
|
# ── Product ───────────────────────────────────────────────────────
|
|
- { source_path: "'InsightIDR'", ocsf_field: "metadata.product.name" }
|
|
- { source_path: "'Rapid7'", ocsf_field: "metadata.product.vendor_name" }
|
|
- { source_path: "'riposte-relay'", ocsf_field: "metadata.log_provider" }
|
|
- { source_path: "source", ocsf_field: "metadata.log_name" }
|
|
- { source_path: "[verified.('relay:' & $)]", ocsf_field: "metadata.labels" }
|
|
- { source_path: "body", ocsf_field: "raw_data" }
|
|
# ── Asset ─────────────────────────────────────────────────────────
|
|
- { source_path: "hostname", ocsf_field: "device.hostname" }
|
|
# ── Rapid7 specifics ──────────────────────────────────────────────
|
|
- { source_path: "log_set", ocsf_field: "unmapped.rapid7.log_set" }
|
|
- { source_path: "log_name", ocsf_field: "unmapped.rapid7.log_name" }
|
|
- { source_path: "log_key", ocsf_field: "unmapped.rapid7.log_key" }
|
|
- { source_path: "region", ocsf_field: "unmapped.rapid7.region" }
|
|
- { source_path: "event_sequence", ocsf_field: "unmapped.rapid7.event_sequence" }
|
|
- { source_path: "log_line", ocsf_field: "unmapped.rapid7.log_line" }
|
|
- { source_path: "log_line_withheld", ocsf_field: "unmapped.rapid7.log_line_withheld" }
|
|
# The vendor's cloud, never an entity (see the generic mapper).
|
|
- { source_path: "remote_ip", ocsf_field: "unmapped.relay.sender_ip" }
|