f3nris ea04ea586c fix(sekoia-xdr): mapper reviewed on a real alert (1.2.0) ...

- incident source is 'Sekoia XDR'; Sekoia's `source` (the alert's source
  address) goes to src_endpoint.ip/.hostname, `target` to dst_endpoint;
- description: the alert's sentence with {rule:<uuid>} replaced by the rule
  name; the rule documentation (`details`) moves to analytic.desc;
- every TTP mapped into attacks; kill_chain_short_id no longer written as
  an ATT&CK tactic uid;
- OCSF times in epoch ms; finding_info.types, analytic.category,
  metadata.product added.

Checked with Riposte's mapper preview on the alert and a variant (IPv4
source, named target, one TTP): no expression error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-07 09:13:03 +00:00

..

list_alerts.yaml

fix(sekoia-xdr): mapper reviewed on a real alert (1.2.0)

2026-10-07 09:13:03 +00:00