306581e70b
Jira Cloud and On-Prem/Data Center (27 commands): JQL ingestion with an OCSF mapper and JQL query, full issue lifecycle (create/get/edit/delete, transitions, assign), comments, remote web links and issue links, attachments (upload/download/delete), field and user lookups, and agile boards/sprints/epics. Basic (email + API token) or Personal Access Token authentication; API v3 + ADF bodies on Cloud, v2 on On-Prem. Stdlib-only, no extra Python dependencies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
24 lines
1.7 KiB
YAML
24 lines
1.7 KiB
YAML
name: "Jira Issues → OCSF"
|
|
description: "Maps a Jira issue (get_incidents, results_path = result) to OCSF finding fields. Issues are flattened by the fetch script (nested fields.* and ADF/rendered descriptions are resolved to plain values)."
|
|
field_mappings:
|
|
title: "summary"
|
|
severity: "priority = 'Highest' ? 5 : (priority = 'High' ? 4 : (priority = 'Medium' ? 3 : 2))"
|
|
description: "description"
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "key", ocsf_field: "finding_info.uid_alt" }
|
|
- { source_path: "summary", ocsf_field: "finding_info.title" }
|
|
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "created", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "updated", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "url", ocsf_field: "finding_info.src_url" }
|
|
- { source_path: "issue_type", ocsf_field: "finding_info.types" }
|
|
- { source_path: "project", ocsf_field: "finding_info.analytic.category" }
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
- { source_path: "resolution", ocsf_field: "disposition" }
|
|
# ── People ────────────────────────────────────────────────────────
|
|
- { source_path: "reporter", ocsf_field: "actor.user.name" }
|
|
- { source_path: "assignee", ocsf_field: "assignee.name" }
|
|
- { source_path: "creator", ocsf_field: "user.name" }
|