f3nris 5cf870309f feat(harfanglab): describe an incident with the rule's message (1.7.1) ...

The get_security_events and get_alerts mappers set an incident's
description to alert_type alone — "sigma", "yara" — which says nothing
an analyst can act on. It now takes msg, the rule's own account of what
it detects and what to check, and falls back to the alert type only on
alerts that carry no message. Folded into the unreleased 1.7.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXFMuDDLohs4qnL12mBJoP

2026-10-07 19:11:35 +00:00

..

get_alerts.yaml

feat(harfanglab): describe an incident with the rule's message (1.7.1)

2026-10-07 19:11:35 +00:00

get_security_events.yaml

feat(harfanglab): describe an incident with the rule's message (1.7.1)

2026-10-07 19:11:35 +00:00

get_threats.yaml

feat(harfanglab): map the fields the alert and threat payloads actually carry (v1.4.0)

2026-08-06 17:30:01 +02:00