f3nris 9f9ee5344d
fix(cortex-xdr): put the actor where the other EDR mappers put it ...
HarfangLab and SentinelOne both send the process that acted to actor.* —
process.username and sourceProcessInfo.user to actor.user.name, the process
itself to actor.process.* — and keep user.name for the person the event
happened to: HarfangLab's top_impacted_users, SentinelOne's login account.
Cortex XDR filled neither slot correctly. XDR labels the acting process
actor_process_* and its account actor_effective_username; the mappers sent
the process to process.* and the account to user.name, which the OCSF
catalogue calls Target User. A rule written on actor.user.name or
actor.process.name matched HarfangLab and SentinelOne and skipped Cortex,
and a rule reading user.name as the victim read the attacker.
process.* is not free-for-all either: in the SentinelOne (targetProcessInfo)
and Carbon Black (childproc_*) mappers it holds the process acted upon, so
Cortex's actor was sitting in the target's seat.
get_incidents_full had the collision in the open: the incident's impacted
users[] and the first alert's user_name both wrote user.name, and last
non-empty wins, so the actor overwrote the impacted user on every incident
carrying both.
Tenants using the shipped templates pick this up on the next sync; a forked
mapper, or a column or rule pointed at the old Cortex paths, needs repointing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-21 17:03:06 +02:00
2026-07-11 22:33:03 +02:00
2026-06-26 17:22:22 +02:00
2026-07-11 22:33:10 +02:00
2026-07-12 00:15:11 +02:00
2026-07-11 22:48:50 +02:00
2026-07-12 14:41:43 +02:00
2026-07-12 21:59:06 +02:00
2026-07-11 23:54:00 +02:00
2026-07-12 14:41:43 +02:00
2026-07-11 23:54:01 +02:00
2026-07-12 15:39:18 +02:00
2026-07-12 14:15:54 +02:00
2026-07-12 15:23:56 +02:00
2026-07-12 00:42:01 +02:00
2026-07-15 22:37:07 +02:00
2026-07-11 22:39:29 +02:00
2026-07-12 00:20:41 +02:00
2026-07-12 00:25:51 +02:00
2026-07-12 00:20:41 +02:00
2026-07-12 21:59:07 +02:00
2026-07-15 22:37:07 +02:00
2026-07-11 23:13:24 +02:00
2026-07-12 00:20:40 +02:00
2026-07-12 15:23:56 +02:00
2026-08-21 17:03:06 +02:00
2026-07-12 16:07:37 +02:00
2026-06-27 10:38:09 +02:00
2026-07-12 00:42:00 +02:00
2026-07-12 21:37:31 +02:00
2026-07-11 23:37:54 +02:00
2026-07-15 22:37:07 +02:00
2026-07-12 00:48:00 +02:00
2026-07-12 15:08:51 +02:00
2026-07-12 15:39:18 +02:00
2026-07-12 14:22:04 +02:00
2026-07-12 21:59:05 +02:00
2026-07-12 15:23:56 +02:00
2026-07-11 23:37:53 +02:00
2026-07-12 15:49:16 +02:00
2026-07-12 21:13:22 +02:00
2026-07-12 00:25:50 +02:00
2026-07-11 22:39:29 +02:00
2026-07-12 00:48:03 +02:00
2026-07-12 15:44:28 +02:00
2026-07-13 12:08:48 +02:00
2026-07-12 22:59:19 +02:00
2026-07-13 12:15:50 +02:00
2026-07-12 22:59:20 +02:00
2026-07-13 12:12:34 +02:00
2026-07-13 12:08:49 +02:00
2026-07-12 22:43:16 +02:00
2026-07-12 22:59:18 +02:00
2026-07-12 23:02:11 +02:00
2026-07-12 22:49:28 +02:00
2026-07-13 12:12:35 +02:00
2026-07-13 12:08:49 +02:00
2026-07-12 23:02:10 +02:00
2026-07-13 12:12:34 +02:00
2026-07-13 12:15:50 +02:00
2026-07-12 23:02:11 +02:00
2026-07-12 22:43:17 +02:00
2026-07-13 12:15:49 +02:00
2026-07-12 22:49:30 +02:00
2026-07-12 22:56:36 +02:00
2026-07-12 22:43:17 +02:00
2026-07-12 22:56:36 +02:00
2026-07-12 22:49:29 +02:00
2026-07-12 22:56:35 +02:00
2026-07-12 14:10:26 +02:00
2026-07-11 23:13:24 +02:00
2026-07-12 00:31:45 +02:00
2026-07-12 16:12:38 +02:00
2026-07-11 23:54:02 +02:00
2026-07-12 15:18:47 +02:00
2026-07-12 15:18:48 +02:00
2026-07-12 16:12:37 +02:00
2026-07-10 23:18:07 +02:00
2026-07-10 23:29:12 +02:00
2026-07-10 23:17:50 +02:00
2026-07-10 23:17:58 +02:00
2026-07-12 15:08:50 +02:00
2026-07-11 22:33:09 +02:00
2026-08-06 18:15:44 +02:00
2026-07-12 00:57:25 +02:00
2026-07-12 14:15:53 +02:00
2026-07-11 22:48:49 +02:00
2026-07-12 15:44:29 +02:00
2026-07-12 00:37:12 +02:00
2026-07-12 15:49:17 +02:00
2026-07-11 22:58:15 +02:00
2026-07-12 21:53:59 +02:00
2026-08-05 21:01:43 +02:00
2026-07-11 22:58:17 +02:00
2026-07-11 21:56:52 +02:00
2026-07-11 22:48:49 +02:00
2026-07-12 15:14:01 +02:00
2026-07-10 23:48:23 +02:00
2026-07-12 21:37:32 +02:00
2026-07-11 22:39:29 +02:00
2026-07-12 14:58:07 +02:00
2026-07-12 00:15:12 +02:00
2026-07-12 14:22:05 +02:00
2026-07-12 21:53:58 +02:00
2026-07-11 22:22:45 +02:00
2026-07-11 23:46:36 +02:00
2026-07-11 22:22:46 +02:00
2026-06-26 18:13:43 +02:00
2026-07-12 14:10:25 +02:00
2026-07-11 22:22:46 +02:00
2026-07-11 23:28:25 +02:00
2026-07-11 23:46:35 +02:00
2026-07-11 22:58:16 +02:00
2026-06-27 16:20:53 +02:00
2026-07-12 00:37:10 +02:00
2026-07-11 23:37:52 +02:00
2026-07-12 15:14:00 +02:00
2026-06-29 23:24:57 +02:00
2026-06-26 17:44:54 +02:00
2026-07-11 23:28:26 +02:00
2026-07-12 21:13:23 +02:00
2026-07-11 23:28:26 +02:00
2026-07-11 23:13:35 +02:00
2026-07-12 15:14:01 +02:00
2026-07-12 00:53:01 +02:00
2026-07-11 23:46:35 +02:00
2026-07-11 22:39:28 +02:00
2026-07-12 00:25:49 +02:00
2026-07-11 23:59:38 +02:00
2026-07-15 19:18:49 +02:00
2026-06-27 14:00:29 +02:00
2026-07-11 23:59:39 +02:00
2026-06-27 15:19:40 +02:00
2026-06-27 15:19:40 +02:00
2026-07-12 14:22:06 +02:00
2026-07-12 14:41:42 +02:00
2026-07-12 15:39:19 +02:00
2026-07-12 21:37:31 +02:00
2026-07-11 22:48:48 +02:00
2026-06-27 15:04:22 +02:00
2026-06-27 15:04:22 +02:00
2026-08-14 23:48:40 +02:00
2026-06-27 15:34:42 +02:00
2026-07-10 22:48:50 +02:00
2026-07-10 22:54:01 +02:00
2026-07-10 22:57:57 +02:00
2026-06-26 00:18:06 +02:00
2026-07-12 15:44:30 +02:00
2026-07-11 23:28:25 +02:00
2026-07-12 15:18:48 +02:00
2026-07-15 22:37:07 +02:00
2026-06-27 10:38:09 +02:00
2026-07-12 16:07:38 +02:00
2026-07-12 15:08:51 +02:00
2026-07-12 14:10:27 +02:00
2026-07-12 16:12:37 +02:00
2026-07-12 00:57:24 +02:00
2026-07-11 23:59:37 +02:00
2026-07-12 00:31:43 +02:00
2026-07-12 21:53:59 +02:00
2026-07-12 00:15:10 +02:00
2026-07-12 14:58:07 +02:00
2026-07-12 15:49:17 +02:00
2026-07-15 22:37:07 +02:00
2026-07-12 00:42:02 +02:00
2026-07-12 00:57:23 +02:00
2026-07-12 14:15:54 +02:00
2026-07-11 22:33:10 +02:00
2026-07-12 21:13:24 +02:00
2026-07-12 00:53:01 +02:00
2026-07-12 00:48:01 +02:00
2026-06-27 15:53:22 +02:00
2026-06-27 15:34:42 +02:00
2026-07-11 22:58:15 +02:00
2026-07-12 16:07:38 +02:00
2026-07-15 22:37:07 +02:00
2026-07-12 00:53:02 +02:00
2026-07-12 14:58:08 +02:00
2026-07-12 00:31:44 +02:00
2026-07-11 23:13:34 +02:00
2026-07-12 00:37:11 +02:00
f3nris
9f9ee5344d