Corsair Mapping Packs

This repository is the canonical registry of Corsair mapping packs. Mapping packs describe how to translate tool output into Corsair's canonical control model.

Repository layout

index.json                      # Discovery manifest
schemas/                        # JSON schema for index.json
signers/                        # Public keys for pack verification
packs/<tool>/<version>/         # Mapping packs (one tool per version)
  mappings/                     # Mapping JSON files
  fixtures/                     # Sample input + expected output
  pack.json                     # Unsigned pack
  pack.signed.json              # Signed pack (generated by maintainers)

How to contribute a mapping (community)

1. Create a new folder: packs/<tool>/<version>/mappings/
2. Add mapping JSON files.
3. Add fixtures under packs/<tool>/<version>/fixtures/.
4. Build an unsigned pack:

   corsair mappings pack --id <tool> --version <version> \
     --mapping ./packs/<tool>/<version>/mappings \
     --out ./packs/<tool>/<version>/pack.json

5. Run validation:

   corsair mappings validate --file ./packs/<tool>/<version>/pack.json
   bun scripts/validate-index.ts index.json

6. Update index.json with a new entry.
7. Open a PR.

Maintainers will review, sign, and publish a release.

Verification

Consumers should verify pack signatures before use:

export CORSAIR_MAPPING_PACK_PUBKEY="$(cat signers/grcorsair.pub.pem)"
export CORSAIR_MAPPING_FILE=./packs/<tool>/<version>/pack.signed.json
corsair sign --file tool-output.json

Index format (index.json)

index.json is a flat array of entries. Example:

[
  {
    "id": "prowler-aws",
    "tool": "Prowler",
    "version": "1.2.0",
    "description": "Prowler OCSF to Corsair controls",
    "frameworks": ["SOC2", "CIS-AWS"],
    "mappingIds": ["prowler-ocsf"],
    "packUrl": "https://github.com/grcorsair/mappings/releases/download/prowler-aws-v1.2.0/prowler-aws.pack.signed.json",
    "sha256": "<sha256>",
    "signer": "grcorsair",
    "source": "community",
    "publicKeyUrl": "https://github.com/grcorsair/mappings/raw/main/signers/grcorsair.pub.pem",
    "createdAt": "2026-02-19"
  }
]

Index schema + validation

• Schema: schemas/index.schema.json
• Validator: bun scripts/validate-index.ts index.json

Signing rules

• Community packs are signed by the registry key (grcorsair).
• Vendor packs should be signed by the vendor and may be mirrored here.
• The signature inside the pack is the source of truth.

License

Apache-2.0