Guillaume BOURGEOIS
35 lines
2.4 KiB
YAML
35 lines
2.4 KiB
YAML
name: "SentinelOne Alerts → OCSF"
|
|
description: "Maps a SentinelOne v2.1 cloud-detection alert object (data[]) to OCSF endpoint/file/process/rule fields."
|
|
field_mappings:
|
|
title: "ruleInfo.name"
|
|
severity: "ruleInfo.severity = 'Critical' ? 5 : (ruleInfo.severity = 'High' ? 4 : 3)"
|
|
description: "alertInfo.eventType"
|
|
# source_path is evaluated against ONE alert object (alert rule results_path = data).
|
|
# Paths absent from a given alert are skipped at ingestion, so extra entries are safe.
|
|
ocsf:
|
|
# Endpoint
|
|
- { source_path: "agentDetectionInfo.name", ocsf_field: "src_endpoint.hostname" }
|
|
- { source_path: "agentDetectionInfo.osName", ocsf_field: "src_endpoint.os.name" }
|
|
- { source_path: "agentDetectionInfo.osRevision", ocsf_field: "device.os.build" }
|
|
- { source_path: "agentDetectionInfo.uuid", ocsf_field: "device.uid" }
|
|
# Rule / finding
|
|
- { source_path: "ruleInfo.name", ocsf_field: "rule.name" }
|
|
- { source_path: "ruleInfo.id", ocsf_field: "rule.uid" }
|
|
- { source_path: "ruleInfo.description", ocsf_field: "rule.desc" }
|
|
- { source_path: "alertInfo.alertId", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "alertInfo.dvEventId", ocsf_field: "metadata.original_event_uid" }
|
|
# Source process
|
|
- { source_path: "sourceProcessInfo.name", ocsf_field: "process.name" }
|
|
- { source_path: "sourceProcessInfo.pid", ocsf_field: "process.pid" }
|
|
- { source_path: "sourceProcessInfo.filePath", ocsf_field: "process.file.path" }
|
|
- { source_path: "sourceProcessInfo.commandline", ocsf_field: "process.cmd_line" }
|
|
- { source_path: "sourceProcessInfo.user", ocsf_field: "process.user.name" }
|
|
- { source_path: "sourceProcessInfo.integrityLevel", ocsf_field: "process.integrity" }
|
|
- { source_path: "sourceProcessInfo.fileHashSha256", ocsf_field: "file.hashes.sha256" }
|
|
- { source_path: "sourceProcessInfo.fileHashSha1", ocsf_field: "file.hashes.sha1" }
|
|
- { source_path: "sourceProcessInfo.fileHashMd5", ocsf_field: "file.hashes.md5" }
|
|
# Parent process
|
|
- { source_path: "sourceParentProcessInfo.name", ocsf_field: "process.parent_process.name" }
|
|
- { source_path: "sourceParentProcessInfo.pid", ocsf_field: "process.parent_process.pid" }
|
|
- { source_path: "sourceParentProcessInfo.commandline", ocsf_field: "process.parent_process.cmd_line" }
|