Guillaume BOURGEOIS
24 lines
1.9 KiB
YAML
24 lines
1.9 KiB
YAML
name: "HarfangLab Threats → OCSF"
|
|
description: "Maps a raw HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results) to OCSF. Uses native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics); the agents/impacted_users/rules arrays are only populated by external enrichment, which this connector does not perform."
|
|
field_mappings:
|
|
title: "slug"
|
|
severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
|
|
description: "status"
|
|
# results_path = results; source_path is JSONata over ONE threat object.
|
|
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "slug", ocsf_field: "finding_info.title" }
|
|
- { source_path: "creation_date", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "first_seen", ocsf_field: "finding_info.first_seen_time" }
|
|
- { source_path: "last_seen", ocsf_field: "finding_info.last_seen_time" }
|
|
- { source_path: "last_update", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
# ── MITRE ATT&CK (native mitre_tactics list) ──────────────────────
|
|
- { source_path: "mitre_tactics[0]", ocsf_field: "attacks.tactic.name" }
|
|
# ── Top impacted endpoint / user / rule (native aggregates) ───────
|
|
- { source_path: "top_agents[0].agent_hostname", ocsf_field: "src_endpoint.hostname" }
|
|
- { source_path: "top_impacted_users[0].user_name", ocsf_field: "user.name" }
|
|
- { source_path: "top_rules[0].rule_name", ocsf_field: "rule.name" }
|