Guillaume BOURGEOIS
36 lines
2.6 KiB
YAML
36 lines
2.6 KiB
YAML
name: "SentinelOne Threats → OCSF"
|
|
description: "Maps a SentinelOne v2.1 threat object (data[]) to OCSF. The malicious file is the subject (file.*); the process that ran it is the actor (actor.*); the host's logged-in user is the affected user (user.*)."
|
|
field_mappings:
|
|
title: "threatInfo.threatName"
|
|
severity: "threatInfo.confidenceLevel = 'malicious' ? 4 : 3"
|
|
description: "threatInfo.classification"
|
|
# source_path is evaluated against ONE threat object (alert rule results_path = data).
|
|
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
|
|
ocsf:
|
|
# Endpoint (where it was seen)
|
|
- { source_path: "agentRealtimeInfo.agentComputerName", ocsf_field: "src_endpoint.hostname" }
|
|
- { source_path: "agentRealtimeInfo.agentDomain", ocsf_field: "src_endpoint.domain" }
|
|
- { source_path: "agentRealtimeInfo.agentOsType", ocsf_field: "src_endpoint.os.type" }
|
|
- { source_path: "agentRealtimeInfo.agentUuid", ocsf_field: "device.uid" }
|
|
- { source_path: "agentDetectionInfo.externalIp", ocsf_field: "src_endpoint.ip" }
|
|
- { source_path: "agentDetectionInfo.agentOsName", ocsf_field: "src_endpoint.os.name" }
|
|
# Affected user (logged in on the host)
|
|
- { source_path: "agentDetectionInfo.agentLastLoggedInUserName", ocsf_field: "user.name" }
|
|
# Finding / malware
|
|
- { source_path: "threatInfo.threatName", ocsf_field: "malware.name" }
|
|
- { source_path: "threatInfo.classification", ocsf_field: "malware.classifications" }
|
|
- { source_path: "threatInfo.threatId", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "threatInfo.confidenceLevel", ocsf_field: "confidence" }
|
|
- { source_path: "threatInfo.mitigationStatus", ocsf_field: "status" }
|
|
# Acting (malicious) process — the actor
|
|
- { source_path: "threatInfo.originatorProcess", ocsf_field: "actor.process.name" }
|
|
- { source_path: "threatInfo.maliciousProcessArguments", ocsf_field: "actor.process.cmd_line" }
|
|
- { source_path: "threatInfo.processUser", ocsf_field: "actor.user.name" }
|
|
# Malicious file — the subject
|
|
- { source_path: "threatInfo.filePath", ocsf_field: "file.path" }
|
|
- { source_path: "threatInfo.fileExtension", ocsf_field: "file.ext" }
|
|
- { source_path: "threatInfo.fileSize", ocsf_field: "file.size" }
|
|
- { source_path: "threatInfo.sha256", ocsf_field: "file.hashes.sha256" }
|
|
- { source_path: "threatInfo.sha1", ocsf_field: "file.hashes.sha1" }
|
|
- { source_path: "threatInfo.md5", ocsf_field: "file.hashes.md5" }
|