Guillaume BOURGEOIS
26 lines
1.9 KiB
YAML
26 lines
1.9 KiB
YAML
name: "HarfangLab Threats → OCSF"
|
|
description: "Maps a HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results, enriched with agents/impacted_users/rules) to OCSF."
|
|
field_mappings:
|
|
title: "slug"
|
|
severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
|
|
description: "status"
|
|
# results_path = results; source_path is JSONata over ONE threat object.
|
|
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "slug", ocsf_field: "finding_info.title" }
|
|
- { source_path: "creation_date", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "first_seen", ocsf_field: "finding_info.first_seen_time" }
|
|
- { source_path: "last_seen", ocsf_field: "finding_info.last_seen_time" }
|
|
- { source_path: "last_update", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
# ── Impacted endpoint (first enriched agent) ──────────────────────
|
|
- { source_path: "agents[0].hostname", ocsf_field: "src_endpoint.hostname" }
|
|
- { source_path: "agents[0].domainname", ocsf_field: "src_endpoint.domain" }
|
|
- { source_path: "agents[0].osproducttype", ocsf_field: "src_endpoint.os.name" }
|
|
- { source_path: "agents[0].ostype", ocsf_field: "src_endpoint.os.type" }
|
|
# ── Impacted user / rule ──────────────────────────────────────────
|
|
- { source_path: "impacted_users[0].full_name", ocsf_field: "user.name" }
|
|
- { source_path: "rules[0].rule_name", ocsf_field: "rule.name" }
|