Guillaume BOURGEOIS
334ecac83e
19 commands (Azure Resource Manager API): incident ingestion + CRUD, comments, related alerts/entities/relations, watchlists, and threat indicators. Azure AD OAuth 2.0 client-credentials, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
19 lines
1.2 KiB
YAML
19 lines
1.2 KiB
YAML
name: "Microsoft Sentinel Incidents → OCSF"
|
|
description: "Maps a Sentinel incident (get_incidents, results_path = result) to OCSF finding fields. The fetch script lifts the ARM 'properties' object to the top level and keeps the incident 'name' (GUID) as the id."
|
|
field_mappings:
|
|
title: "title"
|
|
severity: "severity = 'High' ? 4 : (severity = 'Medium' ? 3 : (severity = 'Low' ? 2 : 1))"
|
|
description: "description"
|
|
ocsf:
|
|
- { source_path: "name", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "incidentNumber", ocsf_field: "finding_info.uid_alt" }
|
|
- { source_path: "title", ocsf_field: "finding_info.title" }
|
|
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "createdTimeUtc", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "lastModifiedTimeUtc", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "incidentUrl", ocsf_field: "finding_info.src_url" }
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
- { source_path: "classification", ocsf_field: "disposition" }
|
|
- { source_path: "owner.assignedTo", ocsf_field: "assignee.name" }
|
|
- { source_path: "labels[0].labelName", ocsf_field: "finding_info.types" }
|