Add Sentinel field mapping validator and CI job

[TFT444]

Summary

Closes #72

Adds scripts/validate_field_mapping.py — a static validator that checks every ARM analytics rule template in sentinel/analytics-rules/ — and wires it into CI as a new field-mapping-validation job (job 6, included in the ci-success gate).

What the validator checks

1. Required ARM properties — displayName, severity, query, queryFrequency, queryPeriod, tactics, techniques, entityMappings, customDetails
2. Severity — must be one of: Informational, Low, Medium, High, Critical
3. ISO 8601 durations — queryFrequency and queryPeriod must match PT#M/H/D/S
4. Tactics — non-empty array
5. MITRE techniques — each entry must match T#### or T####.###
6. Entity mappings — non-empty array; each entry must have entityType and identifier in fieldMappings
7. customDetails — must include PlaybookTrigger and RiskScore
8. Column cross-reference — warns when an entity mapping or customDetails column name is not found in the corresponding KQL rule's output columns (detected via extend/project/summarize analysis)

The validator exits 0 with a message when sentinel/analytics-rules/ doesn't exist yet (so CI passes on branches that predate that directory).

CI change

Added job field-mapping-validation to .github/workflows/ci.yml between the existing job 5 (frontend-build) and the gate. Added to needs list in ci-success.

---

How to test

1. Run locally (clean):

   python scripts/validate_field_mapping.py
   # Expected when sentinel/analytics-rules/ present: "All 13 analytics rule templates passed"
   # Expected when directory absent: "No analytics rules directory found — nothing to validate."

2. Introduce a deliberate error — edit any sentinel/analytics-rules/*.json and remove the "RiskScore" key from customDetails. Re-run the script and confirm it exits 1 with a clear error message.

3. Invalid technique code — change a "T1566.001" to "1566" in techniques, confirm the validator catches it.

4. CI — the new field-mapping-validation job should appear in the Actions run for this PR and show green (directory absent → exit 0).

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
retail-shield	Error		Jun 6, 2026 2:05pm