f3nris 815db080f5 feat(webhook-relay): map relayed messages into OCSF, not only custom fields (1.0.1) ...

The generic mapper now fills the OCSF fields a relayed message has a
place for: metadata.logged_time, log_provider and log_name, the checks
the delivery passed as metadata.labels (relay:hmac…), and raw_data. The
sender's address goes to unmapped.relay.sender_ip rather than
src_endpoint.ip: it is the vendor's cloud, and as an entity it would
correlate every alert of that vendor. metadata.product.name no longer
holds the source id.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xa1QDbsPTYiVREv2Cvs3Zn

2026-10-16 15:48:27 +00:00

..

incident-types

feat(webhook-relay): read the alerts vendors push to riposte-relay (1.0.0)

2026-10-16 11:23:03 +00:00

mappers

feat(webhook-relay): map relayed messages into OCSF, not only custom fields (1.0.1)

2026-10-16 15:48:27 +00:00

scripts

feat(webhook-relay): read the alerts vendors push to riposte-relay (1.0.0)

2026-10-16 11:23:03 +00:00

manifest.yaml

feat(webhook-relay): map relayed messages into OCSF, not only custom fields (1.0.1)

2026-10-16 15:48:27 +00:00