Guillaume BOURGEOIS
7e96048446
Built from the published OpenAPI spec for mock instance s1 (type: edr). Incident ingestion (list_incidents) with since/after_id paging and an OCSF mapper + 'Mock EDR Incident' default type, plus an acknowledge/resolve/dismiss incident action. X-API-Key auth; the instance path segment is configurable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
24 lines
1.5 KiB
YAML
24 lines
1.5 KiB
YAML
name: "Mock EDR Incidents → OCSF"
|
|
description: "Maps a Mock EDR incident (/api/<instance>/incidents, results_path = items) to OCSF Detection Finding fields."
|
|
field_mappings:
|
|
title: "title"
|
|
description: "description"
|
|
source: "source"
|
|
# toSeverity maps critical→5, high→3, medium→2, low→1, informational→1.
|
|
severity: "severity"
|
|
# results_path = items; source_path is JSONata over ONE incident object.
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "external_id", ocsf_field: "metadata.uid" }
|
|
- { source_path: "title", ocsf_field: "finding_info.title" }
|
|
- { source_path: "description", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "created_at", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "status", ocsf_field: "status" }
|
|
- { source_path: "source", ocsf_field: "metadata.product.name" }
|
|
# ── Affected host / artefact ──────────────────────────────────────
|
|
- { source_path: "hostname", ocsf_field: "src_endpoint.hostname" }
|
|
- { source_path: "ip_address", ocsf_field: "src_endpoint.ip" }
|
|
- { source_path: "hostname", ocsf_field: "device.hostname" }
|
|
- { source_path: "file_path", ocsf_field: "file.path" }
|