f3nris
0444e120fa
NG-SIEM correlation rules file their detections in the unified Alerts API under product 'ngsiem'. search_detections defaults to epp/ldt and maps device/process/file blocks those detections do not carry. New search_ngsiem_detections command (product clause always kept, filter ANDed, created_from watermark), its own first-cut mapper on the fields every unified alert carries, and a CrowdStrike NG-SIEM Detection type. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
28 lines
2.3 KiB
YAML
28 lines
2.3 KiB
YAML
name: "CrowdStrike Next-Gen SIEM Detections → OCSF"
|
|
description: "First cut of the map of a Falcon Next-Gen SIEM detection (alerts/entities/alerts/v2 filtered on product 'ngsiem', results_path = resources) to OCSF. An NG-SIEM detection is raised by a correlation rule over ingested logs, not by the sensor: it carries no device, process or file block, so none of the EDR paths of search_detections apply. Only the fields every unified alert carries are mapped here; hosts, users, IPs and the source log come with the first real payload."
|
|
field_mappings:
|
|
title: "name"
|
|
# Plain path: the ingestion engine reads informational/low/medium/high/critical natively.
|
|
severity: "severity_name"
|
|
description: "description"
|
|
# results_path = resources; source_path is JSONata over ONE alert object.
|
|
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
|
|
ocsf:
|
|
# ── Finding / analytic ────────────────────────────────────────────
|
|
- { source_path: "composite_id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "name", ocsf_field: "finding_info.title" }
|
|
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "created_timestamp", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "created_timestamp", ocsf_field: "time" }
|
|
- { source_path: "updated_timestamp", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "type", ocsf_field: "finding_info.types" }
|
|
- { source_path: "confidence", ocsf_field: "confidence" }
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
- { source_path: "product", ocsf_field: "metadata.product.feature.name" }
|
|
- { source_path: "cid", ocsf_field: "cloud.account.uid" }
|
|
# ── MITRE ATT&CK ──────────────────────────────────────────────────
|
|
- { source_path: "tactic", ocsf_field: "attacks.tactic.name" }
|
|
- { source_path: "tactic_id", ocsf_field: "attacks.tactic.uid" }
|
|
- { source_path: "technique", ocsf_field: "attacks.technique.name" }
|
|
- { source_path: "technique_id", ocsf_field: "attacks.technique.uid" }
|