{
  "mapping_id": "alert-ingest.tianqing.v1",
  "mapping_revision": "0.1.0",
  "source_product": "tianqing",
  "alert_type": "SOURCE_ALERT",
  "notes": [
    "输入是奇安信天擎 edr_alert_log（type=edr_alert）原始日志及其已落库的 sdm_event 行；本契约描述 raw.alert_id 等源字段到 v0.2 sdm_alert 各列的映射。",
    "severity 字典依据《奇安信天擎终端安全管理系统 V10.0R7 Syslog 接口说明和字典表 V1.11》：severity int32 风险等级，2=低、3=中、4=高；1 视为提示（INFO）。",
    "ATT&CK 优先使用源告警自带 technique_id/tactic_id（如 T1110/TA0006）；源未提供时（如 IP 检测类）回落 category 规则。",
    "category 关键词匹配 haystack = sample_slug + alert_name.zh_CN + description + technique + tactic + ioc_alerts 文本，全部小写。",
    "tenant fallback=tenant01 仅样例期假设；生产接入 tenant_from=platform.tenant_id，fallback 必须置 null。",
    "rule_id 保留天擎规则库原值（如 41.0.0198），不改写；rule_type 源未提供，置 null。"
  ],
  "constants": {
    "workflow_status": "NEW",
    "verdict": "UNKNOWN",
    "detection_engine": "tianqing",
    "rule_type": null
  },
  "identity": {
    "alert_id_derivation": "sha256(tenant_id || 0x1F || dedup_key)[0:24] prefix alert_",
    "display_id_derivation": "ALT-{first_seen UTC YYYYMMDD}-{sha1(dedup_key)[0:8] upper}",
    "dedup_key_parts": [
      "tenant_id",
      "source_product",
      "source_alert_id"
    ],
    "dedup_separator": "|",
    "source_alert_id_from": [
      "raw.alert_id",
      "event.source_original_event_id"
    ]
  },
  "correlation": {
    "derivation": "corr_ + sha256(parts || 0x1F joined)[0:16]",
    "family_rule": "同一战役：同 victim host 的天擎 EDR 告警链（爆破/登录失败/横向/C2）在 15 分钟窗内共享 family=tianqing_rdp_bruteforce_chain；rule_id 各不相同，弱关联无法合并，必须走 correlation_id 强关联",
    "parts": [
      "tenant_id",
      "source_product",
      "family",
      "victim_entity_id",
      "attacker_entity_id",
      "window"
    ],
    "window_ms": 900000
  },
  "tenant": {
    "tenant_from": "platform.tenant_id",
    "fallback": "tenant01"
  },
  "semantics": {
    "alert_name_from": "raw.alert_name.zh_CN",
    "description_from": "raw.description",
    "rule_name_from": "raw.alert_name.zh_CN",
    "event_count_from": null,
    "event_count_default": 1,
    "severity": {
      "from": "raw.severity",
      "dictionary": {
        "1": "INFO",
        "2": "LOW",
        "3": "MEDIUM",
        "4": "HIGH"
      },
      "default": "MEDIUM",
      "fallback_from": null
    },
    "confidence": null,
    "risk_from_severity": {
      "INFO": 15,
      "LOW": 35,
      "MEDIUM": 55,
      "HIGH": 80,
      "CRITICAL": 95
    },
    "risk_adjustment": null,
    "category": {
      "match_fields": [
        "sample_slug",
        "raw.alert_name.zh_CN",
        "raw.description",
        "raw.technique",
        "raw.tactic",
        "raw.technique_id",
        "raw.tactic_id",
        "raw.ioc_alerts[*].*"
      ],
      "rules": [
        {
          "any_of": [
            "爆破",
            "brute force",
            "登录失败",
            "login failed",
            "修改密码",
            "changed password",
            "账户",
            "account manipulation"
          ],
          "category_code": "AUTH_VIOLATION",
          "tactic_id": "TA0006",
          "technique_id": "T1110"
        },
        {
          "any_of": [
            "横向",
            "psexec",
            "远程启动",
            "started remotely",
            "lateral"
          ],
          "category_code": "NETWORK_SUSPICIOUS",
          "tactic_id": null,
          "technique_id": null
        },
        {
          "any_of": [
            "恶意域名",
            "malicious domain",
            "木马",
            "trojan",
            "远控",
            "定向攻击",
            "apt",
            "c2",
            "ip日志检测"
          ],
          "category_code": "NETWORK_COMMAND_AND_CONTROL",
          "tactic_id": "TA0011",
          "technique_id": "T1071"
        }
      ],
      "default": {
        "category_code": "NETWORK_SUSPICIOUS",
        "tactic_id": null,
        "technique_id": null
      }
    },
    "extensions_from_finding": [
      "alert_name",
      "description",
      "severity",
      "category_id",
      "rule_id",
      "technique",
      "tactic",
      "status",
      "ioc",
      "computer_name",
      "report_ip"
    ]
  },
  "entity": {
    "primary": {
      "selection": "规范算法见 02-alert-fields §3（服务统一派生，规则不填写）：role_rank victim=0,affected=1,attacker=2,indicator=3,related=4; type_rank host=0,user=1,account=2,service=3,ip=4,domain=5,其余=9; hint_rank target=0,source=1,related=2,未声明=9; 兜底 entity_value 升序；observer 不参与；占位值（0.0.0.0/内网IP范围/空串/unknown/-）剔除；host 仅存 IP 值时降级 ip；无合格候选四列全 NULL",
      "from_roles": "roles + raw.computer_name（victim host）+ description/risky_source.ip 中的攻击源（attacker ip）+ ioc_alerts.matched_ioc（域名或 IP indicator）",
      "id_prefix": {
        "host": "host:{tenant}:",
        "user": "user:{tenant}:",
        "account": "account:{tenant}:",
        "service": "service:{tenant}:",
        "ip": "ip:",
        "domain": "domain:"
      }
    },
    "extra": [
      {
        "from_roles": "raw.computer_name",
        "alert_entity_role": "victim",
        "entity_type": "host",
        "used_for_grouping": true
      },
      {
        "from_roles": "risky_source.ip / description 中的攻击源 IP",
        "alert_entity_role": "attacker",
        "entity_type": "ip",
        "used_for_grouping": false
      },
      {
        "from_roles": "ioc_alerts.matched_ioc（域名）",
        "alert_entity_role": "indicator",
        "entity_type": "domain",
        "used_for_grouping": false
      },
      {
        "from_roles": "ioc_alerts.matched_ioc（IP[:端口]）",
        "alert_entity_role": "indicator",
        "entity_type": "ip",
        "used_for_grouping": false
      }
    ],
    "grouping_weights": {
      "host": 0.85,
      "user": 0.85,
      "account": 0.85,
      "service": 0.4,
      "ip_internal": 0.35,
      "ip_external": 0.1,
      "domain": 0.2,
      "default": 0.15
    },
    "internal_ip_rule": "RFC1918 + 203.0.113.123/8（样例实验网段）",
    "used_for_grouping_rule": "role in {victim,affected} 且 entity_type in {host,user,account}"
  },
  "evidence": {
    "trigger": {
      "evidence_type": "EVENT",
      "event_id_from": "event.event_id",
      "raw_log_id_from": "event.log_id",
      "summary_template": "天擎源告警 {raw.alert_id}（{raw.alert_name.zh_CN}）：{raw.description}"
    },
    "context": [
      {
        "evidence_type": "SOURCE_ALERT",
        "source_from": "raw.alert_id",
        "summary_template": "天擎源告警 {raw.alert_id}（{raw.alert_name.zh_CN}）。"
      },
      {
        "evidence_type": "RAW_LOG",
        "source_from": "event.log_id",
        "summary_template": "平台原始日志 {event.log_id}。"
      }
    ]
  },
  "times": {
    "first_seen_from": "raw.create_time（转 DATETIME(3) 本地墙钟(+08:00))",
    "last_seen_from": null,
    "created_time_from": "event.ingest_time",
    "pipeline_lags_ms": null
  },
  "forbidden": {
    "verdict_from_event": false,
    "workflow_status_from_event": false,
    "case_id_from_event": false,
    "analysis_fields_from_event": false,
    "notes": [
      "verdict 恒 UNKNOWN，只有策略或人可改。",
      "case_id 由案件服务在 GATE 之后写，导入层不得预填。",
      "佐证日志（进程/PowerShell/注入/DNS/文件）只写 sdm_event，由 Case Service 在证据收集阶段检索，导入层不写 CASE 证据。",
      "extensions.source_finding 只透传源告警已有字段，不新造结论；PDF 的 status 是天擎侧分析处置流，不映射 verdict/workflow_status。"
    ]
  }
}