Sync upstream features; preserve fork KV scanner, parsers, verifier

Brought in 35 upstream commits (MITRE heatmap, health score, dependency map, PowerQuery playground, onboarding tracker, product grouping, modern UI redesign). Preserved fork additions: backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode, /parsers + /sync-from-sdl endpoints parsers/ 96 OCSF + tenant parsers tools/stormshield-verify/ end-to-end ingest regression test .gitignore un-ignored parsers/* CHANGES.md, PATCHES.md
2026-06-08 12:33:51 +00:00 · 2026-05-22 18:19:52 +02:00
parent a7ebcac9a6
commit 7c1687efce
102 changed files with 13912 additions and 178 deletions
@@ -0,0 +1,85 @@
+{
+  attributes: {
+    "dataSource.vendor": "Proofpoint",
+    "dataSource.category": "security"
+  },
+  formats: [
+    {
+      id: "format1",
+      format: "${parse=dottedjson}$"
+      rewrites: [
+        {input: "messageTime", output: "timestamp", match: ".*", replace: "$0"},
+        {input: "clickTime", output: "unmapped.clickTime", match: ".*", replace: "$0"},
+
+        {input: "threatsInfoMap", output: "unmapped.threatsInfoMap", match: ".*", replace: "$0"},
+        {input: "messageParts", output: "unmapped.messageParts", match: ".*", replace: "$0"},
+        {input: "quarantineFolder", output: "unmapped.quarantineFolder", match: ".*", replace: "$0"},
+        {input: "impostorScore", output: "unmapped.impostorScore", match: ".*", replace: "$0"},
+        {input: "phishScore", output: "unmapped.phishScore", match: ".*", replace: "$0"},
+        {input: "policyRoutes", output: "unmapped.policyRoutes", match: ".*", replace: "$0"},
+
+        {input: "threatStatus", output: "unmapped.threatStatus", match: ".*", replace: "$0"},
+        {input: "threatsInfoMap[0].threatStatus", output: "unmapped.threatStatus", match: ".*", replace: "$0"},
+
+        {input: "classification", output: "unmapped.classification", match: ".*", replace: "$0"},
+        {input: "threatsInfoMap[0].classification", output: "unmapped.classification", match: ".*", replace: "$0"},
+
+        {input: "sender", output: "unmapped.sender", match: ".*", replace: "$0"},
+        {input: "recipient", output: "unmapped.recipient", match: ".*", replace: "$0"},
+
+        {input: "sender", output: "email.from", match: ".*", replace: "$0"},
+        {input: "fromAddress[0]", output: "email.from", match: ".*", replace: "$0"},
+        {input: "fromAddress", output: "email.from", match: ".*", replace: "$0"},
+
+        {input: "recipient", output: "email.to", match: ".*", replace: "$0"},
+        {input: "toAddresses[0]", output: "email.to", match: ".*", replace: "$0"},
+        {input: "toAddresses", output: "email.to", match: ".*", replace: "$0"},
+
+        {input: "recipient", output: "actor.user.name", match: ".*", replace: "$0"},
+        {input: "toAddresses[0]", output: "actor.user.name", match: ".*", replace: "$0"},
+        {input: "toAddresses", output: "actor.user.name", match: ".*", replace: "$0"},
+
+        {input: "messageSize", output: "email.size", match: ".*", replace: "$0"},
+        {input: "headerFrom", output: "email.smtp_from", match: ".*", replace: "$0"},
+
+        {input: "oext", output: "oext", match: ".*", replace: "$0"},
+        {input: "mod", output: "mod", match: ".*", replace: "$0"}
+      ]
+    }
+  ],
+  mappings: {
+    version: 1,
+    mappings: [
+      {
+        predicate: "clickTime = * OR clickIP = * OR threatURL = *",
+        transformations: [
+          { constant: { field: "dataSource.name", value: "Proofpoint" } },
+          { constant: { field: "event.type", value: "Click" } },
+          { copy: { from: "fromAddress[0]", to: "email.from" } },
+          { copy: { from: "toAddresses[0]", to: "email.to" } },
+          { copy: { from: "toAddresses[0]", to: "actor.user.name" } },
+          { copy: { from: "recipient", to: "actor.user.name" } }
+        ]
+      },
+      {
+        predicate: "messageTime = * OR messageParts = * OR threatsInfoMap = *",
+        transformations: [
+          { constant: { field: "dataSource.name", value: "Proofpoint" } },
+          { constant: { field: "event.type", value: "Email" } },
+          { copy: { from: "fromAddress[0]", to: "email.from" } },
+          { copy: { from: "toAddresses[0]", to: "email.to" } },
+          { copy: { from: "toAddresses[0]", to: "actor.user.name" } },
+          { copy: { from: "recipient", to: "actor.user.name" } }
+        ]
+      },
+      {
+        predicate: "true",
+        transformations: [
+          { constant: { field: "dataSource.name", value: "Proofpoint" } },
+          { constant: { field: "event.type", value: "Other" } },
+
+        ]
+      }
+    ]
+  }
+}