diff --git a/Packs/soc-framework-nist-ir/Lists/SOCFrameworkNormalizeMap_NIST_IR/SOCFrameworkNormalizeMap_NIST_IR_data.json b/Packs/soc-framework-nist-ir/Lists/SOCFrameworkNormalizeMap_NIST_IR/SOCFrameworkNormalizeMap_NIST_IR_data.json index e6861113..f52cc108 100644 --- a/Packs/soc-framework-nist-ir/Lists/SOCFrameworkNormalizeMap_NIST_IR/SOCFrameworkNormalizeMap_NIST_IR_data.json +++ b/Packs/soc-framework-nist-ir/Lists/SOCFrameworkNormalizeMap_NIST_IR/SOCFrameworkNormalizeMap_NIST_IR_data.json @@ -34,6 +34,13 @@ "endpoint": { "status": "complete", "mappings": [ + { + "target": "Endpoint.alert_source", + "issue_field": "case.incident_sources.[0]", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, { "target": "Endpoint.alert_name", "issue_field": "name", @@ -753,6 +760,281 @@ "shape": "flat", "role": "canonical", "source_origin": "native" + }, + { + "target": "Artifacts.Process.Name", + "issue_field": "actor_process_image_name", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Path", + "issue_field": "actor_process_image_path", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.SHA256", + "issue_field": "actor_process_image_sha256", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.CommandLine", + "issue_field": "actor_process_command_line", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.PID", + "issue_field": "actor_process_os_pid", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Signer", + "issue_field": "actor_process_signature_vendor", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Causality.ID", + "issue_field": "causality_actor_causality_id", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Parent.Name", + "issue_field": "parentprocessname", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Parent.Name", + "issue_field": "causality_actor_process_image_name", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Parent.Path", + "issue_field": "parentprocesspath", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Parent.Path", + "issue_field": "causality_actor_process_image_path", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Parent.SHA256", + "issue_field": "parentprocesssha256", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Process.Parent.SHA256", + "issue_field": "causality_actor_process_image_sha256", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Target.File", + "issue_field": "action_file_name", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Target.Path", + "issue_field": "action_file_path", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Target.SHA256", + "issue_field": "action_file_sha256", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Network.IP", + "issue_field": "action_remote_ip", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Identity.User.Name", + "issue_field": "actor_effective_username", + "shape": "structured", + "role": "canonical", + "source_origin": "native", + "lower": true + }, + { + "target": "Endpoint.file_path", + "issue_field": "action_file_path", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Endpoint.file_sha256", + "issue_field": "action_file_sha256", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Endpoint.process_name", + "issue_field": "actor_process_image_name", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Endpoint.process_path", + "issue_field": "actor_process_image_path", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Endpoint.process_sha256", + "issue_field": "actor_process_image_sha256", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Endpoint.process_cmd", + "issue_field": "actor_process_command_line", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Endpoint.process_pid", + "issue_field": "actor_process_os_pid", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Endpoint.username", + "issue_field": "actor_effective_username", + "shape": "flat", + "role": "canonical", + "source_origin": "native", + "lower": true + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "case.mitre_tactics_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "case.mitre_techniques_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "mitreattcktactic", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "mitreattcktechnique", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Action", + "issue_field": "action", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Module", + "issue_field": "detection_modules.[0]", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "details", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "case.description", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.RiskScore", + "issue_field": "case.aggregated_score", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.IssueCount", + "issue_field": "case.alert_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.UserCount", + "issue_field": "case.user_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.HostCount", + "issue_field": "case.host_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.LinkedCount", + "issue_field": "linkedCount", + "shape": "flat", + "role": "canonical", + "source_origin": "native" } ], "stamps": [ @@ -774,6 +1056,13 @@ "email": { "status": "partial", "mappings": [ + { + "target": "Email.alert_source", + "issue_field": "case.incident_sources.[0]", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, { "target": "Email.alert_name", "issue_field": "name", @@ -1212,22 +1501,120 @@ "shape": "structured", "role": "canonical", "source_origin": "native" - } - ], - "stamps": [ - { - "target": "Email.normalization_source", - "value": "email" }, { - "target": "Email.normalization_source", - "value": "mail_listener" - } - ], - "mirrors": [ - { - "target": "Artifacts.Email.From", - "source": "Email.sender", + "target": "Artifacts.MITRE.Tactic", + "issue_field": "case.mitre_tactics_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "case.mitre_techniques_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "mitreattcktactic", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "mitreattcktechnique", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Action", + "issue_field": "action", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Module", + "issue_field": "detection_modules.[0]", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.AlertDomain", + "issue_field": "alert_domain", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "details", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "case.description", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.RiskScore", + "issue_field": "case.aggregated_score", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.IssueCount", + "issue_field": "case.alert_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.UserCount", + "issue_field": "case.user_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.HostCount", + "issue_field": "case.host_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.LinkedCount", + "issue_field": "linkedCount", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + } + ], + "stamps": [ + { + "target": "Email.normalization_source", + "value": "email" + }, + { + "target": "Email.normalization_source", + "value": "mail_listener" + } + ], + "mirrors": [ + { + "target": "Artifacts.Email.From", + "source": "Email.sender", "role": "canonical", "shape": "structured" }, @@ -1266,6 +1653,13 @@ "identity": { "status": "in-progress", "mappings": [ + { + "target": "Identity.alert_source", + "issue_field": "case.incident_sources.[0]", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, { "target": "Identity.alert_name", "issue_field": "name", @@ -1666,6 +2060,104 @@ "shape": "flat", "role": "canonical", "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "case.mitre_tactics_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "case.mitre_techniques_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "mitreattcktactic", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "mitreattcktechnique", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Action", + "issue_field": "action", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Module", + "issue_field": "detection_modules.[0]", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.AlertDomain", + "issue_field": "alert_domain", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "details", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "case.description", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.RiskScore", + "issue_field": "case.aggregated_score", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.IssueCount", + "issue_field": "case.alert_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.UserCount", + "issue_field": "case.user_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.HostCount", + "issue_field": "case.host_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.LinkedCount", + "issue_field": "linkedCount", + "shape": "flat", + "role": "canonical", + "source_origin": "native" } ], "stamps": [ @@ -1747,6 +2239,13 @@ "network": { "status": "in-progress", "mappings": [ + { + "target": "Network.alert_source", + "issue_field": "case.incident_sources.[0]", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, { "target": "Network.alert_name", "issue_field": "name", @@ -2145,6 +2644,104 @@ "shape": "structured", "role": "canonical", "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "case.mitre_tactics_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "case.mitre_techniques_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "mitreattcktactic", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "mitreattcktechnique", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Action", + "issue_field": "action", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Module", + "issue_field": "detection_modules.[0]", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.AlertDomain", + "issue_field": "alert_domain", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "details", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "case.description", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.RiskScore", + "issue_field": "case.aggregated_score", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.IssueCount", + "issue_field": "case.alert_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.UserCount", + "issue_field": "case.user_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.HostCount", + "issue_field": "case.host_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.LinkedCount", + "issue_field": "linkedCount", + "shape": "flat", + "role": "canonical", + "source_origin": "native" } ], "stamps": [ @@ -2261,6 +2858,13 @@ "cloud": { "status": "complete", "mappings": [ + { + "target": "Cloud.alert_source", + "issue_field": "case.incident_sources.[0]", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, { "target": "Cloud.alert_name", "issue_field": "name", @@ -2603,6 +3207,104 @@ "shape": "structured", "role": "canonical", "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "case.mitre_tactics_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "case.mitre_techniques_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "mitreattcktactic", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "mitreattcktechnique", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Action", + "issue_field": "action", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Module", + "issue_field": "detection_modules.[0]", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.AlertDomain", + "issue_field": "alert_domain", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "details", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "case.description", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.RiskScore", + "issue_field": "case.aggregated_score", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.IssueCount", + "issue_field": "case.alert_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.UserCount", + "issue_field": "case.user_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.HostCount", + "issue_field": "case.host_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.LinkedCount", + "issue_field": "linkedCount", + "shape": "flat", + "role": "canonical", + "source_origin": "native" } ], "stamps": [ @@ -2616,6 +3318,13 @@ "generic": { "status": "complete", "mappings": [ + { + "target": "Generic.alert_source", + "issue_field": "case.incident_sources.[0]", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, { "target": "Generic.primary_entity_type", "issue_field": "primaryusertype", @@ -2909,6 +3618,104 @@ "shape": "structured", "role": "canonical", "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "case.mitre_tactics_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "case.mitre_techniques_ids_and_names", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Tactic", + "issue_field": "mitreattcktactic", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.MITRE.Technique", + "issue_field": "mitreattcktechnique", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Action", + "issue_field": "action", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Module", + "issue_field": "detection_modules.[0]", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.AlertDomain", + "issue_field": "alert_domain", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "details", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Artifacts.Source.Details", + "issue_field": "case.description", + "shape": "structured", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.RiskScore", + "issue_field": "case.aggregated_score", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.IssueCount", + "issue_field": "case.alert_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.UserCount", + "issue_field": "case.user_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.HostCount", + "issue_field": "case.host_count", + "shape": "flat", + "role": "canonical", + "source_origin": "native" + }, + { + "target": "Investigation.LinkedCount", + "issue_field": "linkedCount", + "shape": "flat", + "role": "canonical", + "source_origin": "native" } ], "stamps": [ diff --git a/scenarios/turla_carbon_abnormal_mde.yml b/scenarios/turla_carbon_abnormal_mde.yml index 842bdcda..aef20182 100644 --- a/scenarios/turla_carbon_abnormal_mde.yml +++ b/scenarios/turla_carbon_abnormal_mde.yml @@ -19,8 +19,8 @@ compress_window: 5m # < rules' 20m window minus */10 tick delay; email is earl sources: - name: Abnormal Security file: input_tsv/Abnormal-MITRE-Turla-Carbon-in-XSIAM.tsv - env: .env-brumxdr-abnormal + env: .env-deathstar-abnormal - name: Microsoft Defender file: input_tsv/MS-Defender-Turla-Carbon.tsv - env: .env-brumxdr-defender + env: .env-deathstar-defender diff --git a/schemas/soc-framework/soc-framework-nist-ir/SOCFrameworkNormalizeMap_NIST_IR.yaml b/schemas/soc-framework/soc-framework-nist-ir/SOCFrameworkNormalizeMap_NIST_IR.yaml index 757ea6ba..595c12c0 100644 --- a/schemas/soc-framework/soc-framework-nist-ir/SOCFrameworkNormalizeMap_NIST_IR.yaml +++ b/schemas/soc-framework/soc-framework-nist-ir/SOCFrameworkNormalizeMap_NIST_IR.yaml @@ -28,6 +28,11 @@ categories: endpoint: status: complete mappings: + # Fallback only: the vendor's own alert_source wins when the + # source carries one. The case reports 'Correlation', which + # identifies nothing — it is here for sources like analytics + # alerts that name no vendor at all. + - { target: Endpoint.alert_source, issue_field: 'case.incident_sources.[0]', shape: flat, role: canonical, source_origin: native } - { target: Endpoint.alert_name, issue_field: name, shape: flat, role: canonical, source_origin: native } - { target: Endpoint.alert_source, issue_field: sourcebrand, shape: flat, role: canonical, source_origin: native } - { target: Endpoint.alert_action, issue_field: alertaction, shape: flat, role: canonical, source_origin: native } @@ -133,6 +138,64 @@ categories: - { target: Endpoint.os, issue_field: hostos, shape: flat, role: canonical, source_origin: native } # native XDR agent: fixes Endpoint.os, dead on every source - { target: Endpoint.tactic, issue_field: mitreattcktactic, shape: flat, role: canonical, source_origin: native } # native XDR agent uses mitreattck* naming - { target: Endpoint.technique, issue_field: mitreattcktechnique, shape: flat, role: canonical, source_origin: native } # native XDR agent uses mitreattck* naming + # ── XDM-named endpoint fields ───────────────────────────────────────── + # The rows above read the native XDR agent's initiator*/file* names. Any + # endpoint source feeding the XDM-named actor_*/action_* fields resolved + # nothing — no hash, no path, no command line reached the contract, so + # Eradication had no file to act on. These are XSIAM native alert fields, + # not one vendor's: whichever set a source populates, wins. + - { target: Artifacts.Process.Name, issue_field: actor_process_image_name, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.Path, issue_field: actor_process_image_path, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.SHA256, issue_field: actor_process_image_sha256, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.CommandLine, issue_field: actor_process_command_line, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.PID, issue_field: actor_process_os_pid, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.Signer, issue_field: actor_process_signature_vendor, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.Causality.ID, issue_field: causality_actor_causality_id, shape: structured, role: canonical, source_origin: native } + # Parent identity — Parent.PID and Parent.Signature already exist; the + # binary itself did not, so a parent process could be counted but never named. + - { target: Artifacts.Process.Parent.Name, issue_field: parentprocessname, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.Parent.Name, issue_field: causality_actor_process_image_name, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.Parent.Path, issue_field: parentprocesspath, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.Parent.Path, issue_field: causality_actor_process_image_path, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.Parent.SHA256, issue_field: parentprocesssha256, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Process.Parent.SHA256, issue_field: causality_actor_process_image_sha256, shape: structured, role: canonical, source_origin: native } + # The file the alert acted on — what Eradication deletes or blocks. + - { target: Artifacts.Target.File, issue_field: action_file_name, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Target.Path, issue_field: action_file_path, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Target.SHA256, issue_field: action_file_sha256, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Network.IP, issue_field: action_remote_ip, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Identity.User.Name, issue_field: actor_effective_username, shape: structured, role: canonical, source_origin: native, lower: true } + # Flat twins of the same fields. + - { target: Endpoint.file_path, issue_field: action_file_path, shape: flat, role: canonical, source_origin: native } + - { target: Endpoint.file_sha256, issue_field: action_file_sha256, shape: flat, role: canonical, source_origin: native } + - { target: Endpoint.process_name, issue_field: actor_process_image_name, shape: flat, role: canonical, source_origin: native } + - { target: Endpoint.process_path, issue_field: actor_process_image_path, shape: flat, role: canonical, source_origin: native } + - { target: Endpoint.process_sha256, issue_field: actor_process_image_sha256, shape: flat, role: canonical, source_origin: native } + - { target: Endpoint.process_cmd, issue_field: actor_process_command_line, shape: flat, role: canonical, source_origin: native } + - { target: Endpoint.process_pid, issue_field: actor_process_os_pid, shape: flat, role: canonical, source_origin: native } + - { target: Endpoint.username, issue_field: actor_effective_username, shape: flat, role: canonical, source_origin: native, lower: true } + # ── Shared detection surface (category-agnostic) ───────────────────── + # XDR Analytics emits the fused mitreattck* form, never mitre*name/*id. + # Case rows first, issue rows last: the case MITRE is aggregated across + # the whole case, the issue MITRE describes this alert, and the more + # specific one should win. + - { target: Artifacts.MITRE.Tactic, issue_field: case.mitre_tactics_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: case.mitre_techniques_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Tactic, issue_field: mitreattcktactic, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: mitreattcktechnique, shape: structured, role: canonical, source_origin: native } + # The detector's own metadata: what fired, what it did, what it wrote. + - { target: Artifacts.Source.Action, issue_field: action, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Module, issue_field: 'detection_modules.[0]', shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: details, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: case.description, shape: structured, role: canonical, source_origin: native } + # ── Investigation scope (case-level, identical in every band) ───────── + # Declared in SOCFrameworkPhaseContract_V3 as analysis reads but never + # written. Populated only on a grouped case. + - { target: Investigation.RiskScore, issue_field: case.aggregated_score, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.IssueCount, issue_field: case.alert_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.UserCount, issue_field: case.user_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.HostCount, issue_field: case.host_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.LinkedCount, issue_field: linkedCount, shape: flat, role: canonical, source_origin: native } stamps: - { target: Endpoint.normalization_source, value: endpoint } - { target: Artifacts.Process.Verdict, value: } @@ -143,6 +206,11 @@ categories: email: status: partial mappings: + # Fallback only: the vendor's own alert_source wins when the + # source carries one. The case reports 'Correlation', which + # identifies nothing — it is here for sources like analytics + # alerts that name no vendor at all. + - { target: Email.alert_source, issue_field: 'case.incident_sources.[0]', shape: flat, role: canonical, source_origin: native } - { target: Email.alert_name, issue_field: name, shape: flat, role: canonical, source_origin: native } - { target: Email.alert_source, issue_field: sourcebrand, shape: flat, role: canonical, source_origin: native } - { target: Email.attachment_name, issue_field: 'filename.[0]', shape: flat, role: canonical, source_origin: native } @@ -202,6 +270,29 @@ categories: - { target: Artifacts.MITRE.TacticID, issue_field: mitretacticid, shape: structured, role: canonical, source_origin: native } - { target: Artifacts.MITRE.Technique, issue_field: mitretechniquename, shape: structured, role: canonical, source_origin: native } - { target: Artifacts.MITRE.TechniqueID, issue_field: mitretechniqueid, shape: structured, role: canonical, source_origin: native } + # ── Shared detection surface (category-agnostic) ───────────────────── + # XDR Analytics emits the fused mitreattck* form, never mitre*name/*id. + # Case rows first, issue rows last: the case MITRE is aggregated across + # the whole case, the issue MITRE describes this alert, and the more + # specific one should win. + - { target: Artifacts.MITRE.Tactic, issue_field: case.mitre_tactics_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: case.mitre_techniques_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Tactic, issue_field: mitreattcktactic, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: mitreattcktechnique, shape: structured, role: canonical, source_origin: native } + # The detector's own metadata: what fired, what it did, what it wrote. + - { target: Artifacts.Source.Action, issue_field: action, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Module, issue_field: 'detection_modules.[0]', shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.AlertDomain, issue_field: alert_domain, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: details, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: case.description, shape: structured, role: canonical, source_origin: native } + # ── Investigation scope (case-level, identical in every band) ───────── + # Declared in SOCFrameworkPhaseContract_V3 as analysis reads but never + # written. Populated only on a grouped case. + - { target: Investigation.RiskScore, issue_field: case.aggregated_score, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.IssueCount, issue_field: case.alert_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.UserCount, issue_field: case.user_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.HostCount, issue_field: case.host_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.LinkedCount, issue_field: linkedCount, shape: flat, role: canonical, source_origin: native } stamps: - { target: Email.normalization_source, value: email } - { target: Email.normalization_source, value: mail_listener } @@ -216,6 +307,11 @@ categories: identity: status: in-progress mappings: + # Fallback only: the vendor's own alert_source wins when the + # source carries one. The case reports 'Correlation', which + # identifies nothing — it is here for sources like analytics + # alerts that name no vendor at all. + - { target: Identity.alert_source, issue_field: 'case.incident_sources.[0]', shape: flat, role: canonical, source_origin: native } - { target: Identity.alert_name, issue_field: name, shape: flat, role: canonical, source_origin: native } - { target: Identity.alert_source, issue_field: sourcebrand, shape: flat, role: canonical, source_origin: native } - { target: Identity.client_ip, issue_field: localip, shape: flat, role: canonical, source_origin: native, dedup_key: true, dedup_match: json } @@ -275,6 +371,29 @@ categories: - { target: Primary.Email, issue_field: email, shape: flat, role: canonical, source_origin: native } # on-prem AD wants bare sAMAccountName, not a UPN — its own key - { target: Primary.SamAccountName, issue_field: samaccountname, shape: flat, role: canonical, source_origin: native } + # ── Shared detection surface (category-agnostic) ───────────────────── + # XDR Analytics emits the fused mitreattck* form, never mitre*name/*id. + # Case rows first, issue rows last: the case MITRE is aggregated across + # the whole case, the issue MITRE describes this alert, and the more + # specific one should win. + - { target: Artifacts.MITRE.Tactic, issue_field: case.mitre_tactics_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: case.mitre_techniques_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Tactic, issue_field: mitreattcktactic, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: mitreattcktechnique, shape: structured, role: canonical, source_origin: native } + # The detector's own metadata: what fired, what it did, what it wrote. + - { target: Artifacts.Source.Action, issue_field: action, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Module, issue_field: 'detection_modules.[0]', shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.AlertDomain, issue_field: alert_domain, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: details, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: case.description, shape: structured, role: canonical, source_origin: native } + # ── Investigation scope (case-level, identical in every band) ───────── + # Declared in SOCFrameworkPhaseContract_V3 as analysis reads but never + # written. Populated only on a grouped case. + - { target: Investigation.RiskScore, issue_field: case.aggregated_score, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.IssueCount, issue_field: case.alert_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.UserCount, issue_field: case.user_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.HostCount, issue_field: case.host_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.LinkedCount, issue_field: linkedCount, shape: flat, role: canonical, source_origin: native } stamps: - { target: Identity.normalization_source, value: identity } mirrors: @@ -293,6 +412,11 @@ categories: network: status: in-progress mappings: + # Fallback only: the vendor's own alert_source wins when the + # source carries one. The case reports 'Correlation', which + # identifies nothing — it is here for sources like analytics + # alerts that name no vendor at all. + - { target: Network.alert_source, issue_field: 'case.incident_sources.[0]', shape: flat, role: canonical, source_origin: native } - { target: Network.alert_name, issue_field: name, shape: flat, role: canonical, source_origin: native } - { target: Network.alert_source, issue_field: sourcebrand, shape: flat, role: canonical, source_origin: native } - { target: Network.action, issue_field: action, shape: flat, role: canonical, source_origin: native } @@ -348,6 +472,29 @@ categories: - { target: Artifacts.Endpoint.Hostname, issue_field: agent_hostname, shape: structured, role: canonical, source_origin: native } - { target: Artifacts.Endpoint.AgentID, issue_field: agent_id, shape: structured, role: canonical, source_origin: native } - { target: Artifacts.Endpoint.Domain, issue_field: agent_device_domain, shape: structured, role: canonical, source_origin: native } + # ── Shared detection surface (category-agnostic) ───────────────────── + # XDR Analytics emits the fused mitreattck* form, never mitre*name/*id. + # Case rows first, issue rows last: the case MITRE is aggregated across + # the whole case, the issue MITRE describes this alert, and the more + # specific one should win. + - { target: Artifacts.MITRE.Tactic, issue_field: case.mitre_tactics_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: case.mitre_techniques_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Tactic, issue_field: mitreattcktactic, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: mitreattcktechnique, shape: structured, role: canonical, source_origin: native } + # The detector's own metadata: what fired, what it did, what it wrote. + - { target: Artifacts.Source.Action, issue_field: action, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Module, issue_field: 'detection_modules.[0]', shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.AlertDomain, issue_field: alert_domain, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: details, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: case.description, shape: structured, role: canonical, source_origin: native } + # ── Investigation scope (case-level, identical in every band) ───────── + # Declared in SOCFrameworkPhaseContract_V3 as analysis reads but never + # written. Populated only on a grouped case. + - { target: Investigation.RiskScore, issue_field: case.aggregated_score, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.IssueCount, issue_field: case.alert_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.UserCount, issue_field: case.user_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.HostCount, issue_field: case.host_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.LinkedCount, issue_field: linkedCount, shape: flat, role: canonical, source_origin: native } stamps: - { target: Network.normalization_source, value: network } mirrors: @@ -372,6 +519,11 @@ categories: cloud: status: complete # migrated verbatim from Foundation - Normalize Cloud_V3 mappings: + # Fallback only: the vendor's own alert_source wins when the + # source carries one. The case reports 'Correlation', which + # identifies nothing — it is here for sources like analytics + # alerts that name no vendor at all. + - { target: Cloud.alert_source, issue_field: 'case.incident_sources.[0]', shape: flat, role: canonical, source_origin: native } - { target: Cloud.alert_name, issue_field: name, shape: flat, role: canonical, source_origin: native } - { target: Cloud.alert_source, issue_field: sourcebrand, shape: flat, role: canonical, source_origin: native } - { target: Cloud.principal, issue_field: username, shape: flat, role: canonical, source_origin: native, dedup_key: true, dedup_match: json } @@ -419,6 +571,29 @@ categories: - { target: Artifacts.Endpoint.Hostname, issue_field: agent_hostname, shape: structured, role: canonical, source_origin: native } - { target: Artifacts.Endpoint.AgentID, issue_field: agent_id, shape: structured, role: canonical, source_origin: native } - { target: Artifacts.Endpoint.Domain, issue_field: agent_device_domain, shape: structured, role: canonical, source_origin: native } + # ── Shared detection surface (category-agnostic) ───────────────────── + # XDR Analytics emits the fused mitreattck* form, never mitre*name/*id. + # Case rows first, issue rows last: the case MITRE is aggregated across + # the whole case, the issue MITRE describes this alert, and the more + # specific one should win. + - { target: Artifacts.MITRE.Tactic, issue_field: case.mitre_tactics_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: case.mitre_techniques_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Tactic, issue_field: mitreattcktactic, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: mitreattcktechnique, shape: structured, role: canonical, source_origin: native } + # The detector's own metadata: what fired, what it did, what it wrote. + - { target: Artifacts.Source.Action, issue_field: action, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Module, issue_field: 'detection_modules.[0]', shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.AlertDomain, issue_field: alert_domain, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: details, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: case.description, shape: structured, role: canonical, source_origin: native } + # ── Investigation scope (case-level, identical in every band) ───────── + # Declared in SOCFrameworkPhaseContract_V3 as analysis reads but never + # written. Populated only on a grouped case. + - { target: Investigation.RiskScore, issue_field: case.aggregated_score, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.IssueCount, issue_field: case.alert_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.UserCount, issue_field: case.user_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.HostCount, issue_field: case.host_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.LinkedCount, issue_field: linkedCount, shape: flat, role: canonical, source_origin: native } stamps: - { target: Cloud.normalization_source, value: cloud } mirrors: @@ -427,6 +602,11 @@ categories: generic: status: complete # migrated verbatim from Foundation - Normalize Generic_V3 mappings: + # Fallback only: the vendor's own alert_source wins when the + # source carries one. The case reports 'Correlation', which + # identifies nothing — it is here for sources like analytics + # alerts that name no vendor at all. + - { target: Generic.alert_source, issue_field: 'case.incident_sources.[0]', shape: flat, role: canonical, source_origin: native } - { target: Generic.primary_entity_type, issue_field: primaryusertype, shape: flat, role: canonical, source_origin: native } - { target: Generic.primary_entity_value, issue_field: username, shape: flat, role: canonical, source_origin: native } - { target: Generic.hostname, issue_field: agent_hostname, shape: flat, role: canonical, source_origin: native } @@ -467,6 +647,29 @@ categories: - { target: Artifacts.Endpoint.Hostname, issue_field: agent_hostname, shape: structured, role: canonical, source_origin: native } - { target: Artifacts.Endpoint.AgentID, issue_field: agent_id, shape: structured, role: canonical, source_origin: native } - { target: Artifacts.Endpoint.Domain, issue_field: agent_device_domain, shape: structured, role: canonical, source_origin: native } + # ── Shared detection surface (category-agnostic) ───────────────────── + # XDR Analytics emits the fused mitreattck* form, never mitre*name/*id. + # Case rows first, issue rows last: the case MITRE is aggregated across + # the whole case, the issue MITRE describes this alert, and the more + # specific one should win. + - { target: Artifacts.MITRE.Tactic, issue_field: case.mitre_tactics_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: case.mitre_techniques_ids_and_names, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Tactic, issue_field: mitreattcktactic, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.MITRE.Technique, issue_field: mitreattcktechnique, shape: structured, role: canonical, source_origin: native } + # The detector's own metadata: what fired, what it did, what it wrote. + - { target: Artifacts.Source.Action, issue_field: action, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Module, issue_field: 'detection_modules.[0]', shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.AlertDomain, issue_field: alert_domain, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: details, shape: structured, role: canonical, source_origin: native } + - { target: Artifacts.Source.Details, issue_field: case.description, shape: structured, role: canonical, source_origin: native } + # ── Investigation scope (case-level, identical in every band) ───────── + # Declared in SOCFrameworkPhaseContract_V3 as analysis reads but never + # written. Populated only on a grouped case. + - { target: Investigation.RiskScore, issue_field: case.aggregated_score, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.IssueCount, issue_field: case.alert_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.UserCount, issue_field: case.user_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.HostCount, issue_field: case.host_count, shape: flat, role: canonical, source_origin: native } + - { target: Investigation.LinkedCount, issue_field: linkedCount, shape: flat, role: canonical, source_origin: native } stamps: - { target: Generic.normalization_source, value: generic } mirrors: