Corrected and completed against a real Identity alert.
Wrong data, not just missing:
- device.type read asset.type, which is UNKNOWN on every alert whose
surface is not the endpoint. A domain controller the same alert called
a Server was ingested as an unknown device. asset.category is read
first now, with a numeric device.type_id beside it.
- device.ip took the IPv6 address ahead of the IPv4, so every Windows
host carried a link-local fe80:: address nothing can pivot on, and
which the indicator extractor mined as an IOC all the same.
- The flat file summary went straight into observables, so an alert with
no file — identity, cloud — carried one observable whose name and value
were both the literal string N/A. It now fills file.name and the
file.hashes entry its digest length names, and only when the process
block did not already describe the file.
- finding_info.types is a list, as OCSF and the layout generator expect.
- src_endpoint and dst_endpoint are oriented by the detection rather than
by habit. SentinelOne fills detectionTime.attacker only when a party
distinct from the asset is involved, so its presence decides which way
the pair points: attacker as source and asset as destination when it is
filled, asset as source and no destination when it is not. Mapping the
attacker to dst_endpoint unconditionally announced a domain controller
as the source of the enumeration it had in fact suffered. device.* is
the invariant across both branches, and the asset's full OS version
moved onto it so the flip costs nothing.
- The base event had no clock of its own. time, start_time and end_time
come from detectedAt, firstSeenAt and lastSeenAt, so a timeline no
longer falls back to the moment Riposte polled.
47 entries added, 97 to 144, covering every one of the 120 fields the
query fetches. 23 sit under unmapped.* — the Azure image, instance size
and resource tags, the console-side IP, the Kubernetes cluster,
namespace, node and controller, the agent's connectivity, pending reboot
and policy, the ticket and whether a note exists — surfaced for the page
instead of being left in the raw payload.
Checked by running the platform's own jsonata-go mapping engine over the
real Identity alert, over a STAR alert fetched with_details, over an
alert naming only the attacker's address, and over a bare alert: no
expression errors on any of them, and the process chain, evidences,
attacks and observables come out unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
f3nris
18ae4a24ff