Guillaume BOURGEOIS
ef215daa88
Sekoia XDR (siem): alert ingestion (list_alerts) with an exhaustive OCSF mapper and a bundled 'Sekoia XDR Alert' default type, plus 20 commands across alerts (list/get/search, status workflow, comments), event search jobs (create/status/ results + one-shot search_events), cases, asset management, users, kill chains and a generic authenticated HTTP passthrough. Bearer-token auth, EU host default. SEKOIA Intelligence Center (enrichment): observable/indicator/indicator-context CTI queries plus ip/url/domain/file/email reputation lookups (STIX type resolved automatically). No fetch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
44 lines
3.5 KiB
YAML
44 lines
3.5 KiB
YAML
name: "Sekoia XDR Alerts → OCSF"
|
|
description: "Maps a Sekoia Defend (XDR) alert (/v1/sic/alerts, results_path = items) to OCSF Detection Finding fields. Alerts aggregate the matching events; use search_events for per-event detail."
|
|
field_mappings:
|
|
title: "title"
|
|
description: "details"
|
|
# urgency is a 0-100 score; bucket it onto the 1-5 incident scale. No parentheses (the engine chains
|
|
# right-associatively) and the lowest band uses '>= 0 ? 1' so the literal 1 sits in a then-branch —
|
|
# a bare trailing else is read as a field path, not an integer, and would fall back to the default.
|
|
severity: "urgency.value >= 80 ? 5 : urgency.value >= 60 ? 4 : urgency.value >= 40 ? 3 : urgency.value >= 20 ? 2 : urgency.value >= 0 ? 1 : 1"
|
|
# How the alert was generated.
|
|
source: "source"
|
|
# results_path = items; source_path is JSONata over ONE alert object.
|
|
# Paths absent from a given alert return nothing and are skipped.
|
|
ocsf:
|
|
# ── Finding ───────────────────────────────────────────────────────
|
|
- { source_path: "uuid", ocsf_field: "finding_info.uid" }
|
|
- { source_path: "title", ocsf_field: "finding_info.title" }
|
|
- { source_path: "rule.description", ocsf_field: "finding_info.desc" }
|
|
- { source_path: "created_at", ocsf_field: "finding_info.created_time" }
|
|
- { source_path: "updated_at", ocsf_field: "finding_info.modified_time" }
|
|
- { source_path: "first_seen_at", ocsf_field: "finding_info.first_seen_time" }
|
|
- { source_path: "last_seen_at", ocsf_field: "finding_info.last_seen_time" }
|
|
# ── Detection rule (analytic) ─────────────────────────────────────
|
|
- { source_path: "rule.name", ocsf_field: "finding_info.analytic.name" }
|
|
- { source_path: "rule.uuid", ocsf_field: "finding_info.analytic.uid" }
|
|
- { source_path: "rule.description", ocsf_field: "finding_info.analytic.desc" }
|
|
- { source_path: "rule.type", ocsf_field: "finding_info.analytic.type" }
|
|
# ── Incident state ────────────────────────────────────────────────
|
|
- { source_path: "status.name", ocsf_field: "status" }
|
|
- { source_path: "alert_type.value", ocsf_field: "activity_name" }
|
|
- { source_path: "similar", ocsf_field: "count" }
|
|
- { source_path: "urgency.value", ocsf_field: "risk_score" }
|
|
# ── MITRE ATT&CK (first TTP / kill-chain step) ────────────────────
|
|
- { source_path: "ttps[0].name", ocsf_field: "attacks.technique.name" }
|
|
- { source_path: "ttps[0].id", ocsf_field: "attacks.technique.uid" }
|
|
- { source_path: "kill_chain_short_id", ocsf_field: "attacks.tactic.uid" }
|
|
# ── Target host ───────────────────────────────────────────────────
|
|
- { source_path: "target", ocsf_field: "src_endpoint.hostname" }
|
|
# ── Owning entity / tenant ────────────────────────────────────────
|
|
- { source_path: "entity.name", ocsf_field: "cloud.org.name" }
|
|
- { source_path: "entity.uuid", ocsf_field: "cloud.org.uid" }
|
|
- { source_path: "short_id", ocsf_field: "metadata.uid" }
|
|
- { source_path: "community_uuid", ocsf_field: "metadata.tenant_uid" }
|