XDR - Incoming Mapper
Maps incoming Cortex XDR incidents fields.
Cortex XDR by Palo Alto Networks Mapper (In)
Details
| ID | Cortex XDR - IR-mapper |
|---|---|
| Type | mapping-incoming |
| Version | -1 |
| From Version | 6.0.0 |
| Default Incident Type | — |
| Feed | No |
{ "description": "Maps incoming Cortex XDR incidents fields.", "feed": false, "id": "Cortex XDR - IR-mapper", "name": "XDR - Incoming Mapper", "type": "mapping-incoming", "version": -1, "fromVersion": "6.0.0", "mapping": { "Cortex XDR - Lite": { "dontMapEventToLabels": false, "internalMapping": { "Additional Data": { "complex": { "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Agent Version": { "complex": { "accessor": "agentversion", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Agents ID": { "complex": { "accessor": "endpoint_id", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "CMD line": { "complex": { "accessor": "action_process_image_command_line", "filters": [], "root": "alerts", "transformers": [] } }, "Cloud Provider": { "complex": { "accessor": "cloudprovider", "filters": [], "root": "alerts", "transformers": [] } }, "Detected User": { "complex": { "accessor": "user_name", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Device Id": { "complex": { "accessor": "endpoint_id", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Device Internal IPs": { "complex": { "accessor": "host_ip", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Device Local IP": { "complex": { "accessor": "host_ip", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Device MAC Address": { "complex": { "accessor": "mac", "filters": [], "root": "alerts", "transformers": [] } }, "Device Name": { "complex": { "accessor": "hostname", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Device OS Name": { "complex": { "accessor": "agent_os_type", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Device OS Version": { "complex": { "accessor": "agent_os_sub_type", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "External Category Name": { "simple": "alerts.category" }, "External End Time": { "simple": "modification_time" }, "External Link": { "simple": "xdr_url" }, "External Start Time": { "simple": "creation_time" }, "External Status": { "simple": "status" }, "External System ID": { "simple": "incident_id" }, "File Names": { "simple": "alerts.action_file_name" }, "File Paths": { "simple": "alerts.action_file_path" }, "File SHA256": { "simple": "file_artifacts.filesha256" }, "Hostnames": { "complex": { "accessor": "host_name", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "LastMirroredInTime": { "complex": { "filters": [], "root": "last_mirrored_in", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "MITRE Tactic ID": { "simple": "mitre_tactics_ids_and_names" }, "MITRE Tactic Name": { "simple": "mitre_tactics_ids_and_names" }, "MITRE Technique ID": { "simple": "mitre_techniques_ids_and_names" }, "MITRE Technique Name": { "simple": "mitre_techniques_ids_and_names" }, "OutgoingMirrorError": { "simple": "out_mirror_error" }, "Parent CMD line": { "simple": "alerts.causality_actor_process_command_line" }, "Parent Process CMD": { "simple": "alerts.causality_actor_process_command_line" }, "Parent Process MD5": { "simple": "alerts.causality_actor_process_image_md5" }, "Parent Process Name": { "simple": "alerts.causalityactorprocessimagename" }, "Parent Process SHA256": { "simple": "alerts.causality_actor_process_image_sha256" }, "Process CMD": { "simple": "alerts.actor_process_command_line" }, "Process MD5": { "simple": "alerts.actor_process_image_md5" }, "Process Names": { "complex": { "accessor": "actor_process_image_name", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Process Paths": { "complex": { "accessor": "actor_process_image_path", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Process SHA256": { "simple": "alerts.actor_process_image_sha256" }, "Users": { "simple": "users" }, "XDR Alert Category": { "complex": { "accessor": "category", "filters": [], "root": "alerts", "transformers": [] } }, "XDR Alert Count": { "simple": "alert_count" }, "XDR Alert Name": { "simple": "alerts.name" }, "XDR Alerts": { "simple": "alerts" }, "XDR Assigned User Email": { "simple": "assigned_user_mail" }, "XDR Assigned User Pretty Name": { "simple": "assigned_user_pretty_name" }, "XDR Description": { "simple": "description" }, "XDR Detection Time": { "complex": { "filters": [], "root": "detection_time", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "XDR File Artifacts": { "simple": "file_artifacts" }, "XDR File Name": { "complex": { "accessor": "file_name", "filters": [], "root": "file_artifacts", "transformers": [ { "operator": "uniq" } ] } }, "XDR File SHA256": { "complex": { "accessor": "file_sha256", "filters": [], "root": "file_artifacts", "transformers": [ { "operator": "uniq" } ] } }, "XDR High Severity Alert Count": { "simple": "high_severity_alert_count" }, "XDR Host Count": { "simple": "host_count" }, "XDR Incident ID": { "simple": "incident_id" }, "XDR Low Severity Alert Count": { "simple": "low_severity_alert_count" }, "XDR MITRE Tactics": { "simple": "alerts.mitre_tactic_id_and_name" }, "XDR MITRE Techniques": { "simple": "alerts.mitre_technique_id_and_name" }, "XDR Medium Severity Alert Count": { "simple": "med_severity_alert_count" }, "XDR Modification Time": { "complex": { "filters": [], "root": "modification_time", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "XDR Network Artifacts": { "simple": "network_artifacts" }, "XDR Notes": { "simple": "notes" }, "XDR Resolve Comment": { "simple": "resolve_comment" }, "XDR Starred": { "simple": "starred" }, "XDR Status": { "simple": "status" }, "XDR Status v2": { "simple": "status" }, "XDR URL": { "simple": "xdr_url" }, "XDR User Count": { "simple": "user_count" }, "XDR Users": { "complex": { "accessor": "user_name", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "incident_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "occurred": { "complex": { "filters": [], "root": "creation_time", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "owner": { "simple": "owner" }, "severity": { "complex": { "filters": [], "root": "severity", "transformers": [ { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "1" } }, "toReplace": { "isContext": false, "value": { "simple": "low" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "2" } }, "toReplace": { "isContext": false, "value": { "simple": "medium" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "3" } }, "toReplace": { "isContext": false, "value": { "simple": "high" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "4" } }, "toReplace": { "isContext": false, "value": { "simple": "critical" } } }, "operator": "replace" } ] } } } }, "Cortex XDR Incident": { "dontMapEventToLabels": true, "internalMapping": { "Alert tags": { "complex": { "accessor": "tags", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Hostnames": { "complex": { "accessor": "host_name", "filters": [], "root": "alerts", "transformers": [ { "args": {}, "operator": "uniq" } ] }, "simple": "" }, "IncomingMirrorError": { "complex": null, "simple": "in_mirror_error" }, "LastMirroredInTime": { "complex": { "accessor": "", "filters": [], "root": "last_mirrored_in", "transformers": [ { "args": {}, "operator": "TimeStampToDate" } ] }, "simple": "" }, "OutgoingMirrorError": { "complex": null, "simple": "out_mirror_error" }, "XDR Alert Category": { "complex": { "accessor": "category", "filters": [], "root": "alerts", "transformers": [] }, "simple": "" }, "XDR Alert Count": { "complex": null, "simple": "alert_count" }, "XDR Alert Name": { "complex": null, "simple": "alerts.name" }, "XDR Alerts": { "complex": null, "simple": "alerts" }, "XDR Assigned User Email": { "complex": null, "simple": "assigned_user_mail" }, "XDR Assigned User Pretty Name": { "complex": null, "simple": "assigned_user_pretty_name" }, "XDR Description": { "complex": null, "simple": "description" }, "XDR Detection Time": { "complex": { "accessor": "", "filters": [], "root": "detection_time", "transformers": [ { "args": {}, "operator": "TimeStampToDate" } ] }, "simple": "" }, "XDR File Artifacts": { "complex": null, "simple": "file_artifacts" }, "XDR File Name": { "complex": { "accessor": "file_name", "filters": [], "root": "file_artifacts", "transformers": [ { "args": {}, "operator": "uniq" } ] }, "simple": "" }, "XDR File SHA256": { "complex": { "accessor": "file_sha256", "filters": [], "root": "file_artifacts", "transformers": [ { "args": {}, "operator": "uniq" } ] }, "simple": "" }, "XDR High Severity Alert Count": { "complex": null, "simple": "high_severity_alert_count" }, "XDR Host Count": { "complex": null, "simple": "host_count" }, "XDR Incident ID": { "complex": null, "simple": "incident_id" }, "XDR Low Severity Alert Count": { "complex": null, "simple": "low_severity_alert_count" }, "XDR MITRE Tactics": { "complex": null, "simple": "alerts.mitre_tactic_id_and_name" }, "XDR MITRE Techniques": { "complex": null, "simple": "alerts.mitre_technique_id_and_name" }, "XDR Medium Severity Alert Count": { "complex": null, "simple": "med_severity_alert_count" }, "XDR Modification Time": { "complex": { "accessor": "", "filters": [], "root": "modification_time", "transformers": [ { "args": {}, "operator": "TimeStampToDate" } ] }, "simple": "" }, "XDR Network Artifacts": { "complex": null, "simple": "network_artifacts" }, "XDR Notes": { "complex": null, "simple": "notes" }, "XDR Resolve Comment": { "complex": null, "simple": "resolve_comment" }, "XDR Starred": { "complex": null, "simple": "starred" }, "XDR Status": { "complex": null, "simple": "status" }, "XDR Status v2": { "complex": null, "simple": "status" }, "XDR URL": { "complex": null, "simple": "xdr_url" }, "XDR User Count": { "complex": null, "simple": "user_count" }, "XDR Users": { "complex": { "accessor": "user_name", "filters": [], "root": "alerts", "transformers": [ { "args": {}, "operator": "uniq" } ] }, "simple": "" }, "dbotMirrorDirection": { "complex": null, "simple": "mirror_direction" }, "dbotMirrorId": { "complex": null, "simple": "incident_id" }, "dbotMirrorInstance": { "complex": null, "simple": "mirror_instance" }, "occurred": { "complex": { "accessor": "", "filters": [], "root": "creation_time", "transformers": [ { "args": {}, "operator": "TimeStampToDate" } ] }, "simple": "" }, "owner": { "complex": null, "simple": "owner" }, "severity": { "complex": { "filters": [], "root": "severity", "transformers": [ { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "1" } }, "toReplace": { "isContext": false, "value": { "simple": "low" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "2" } }, "toReplace": { "isContext": false, "value": { "simple": "medium" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "3" } }, "toReplace": { "isContext": false, "value": { "simple": "high" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "4" } }, "toReplace": { "isContext": false, "value": { "simple": "critical" } } }, "operator": "replace" } ] } } } }, "Cortex XDR Port Scan": { "dontMapEventToLabels": false, "internalMapping": { "XDR Alert Count": { "complex": null, "simple": "alert_count" }, "XDR Assigned User Email": { "complex": null, "simple": "assigned_user_mail" }, "XDR Assigned User Pretty Name": { "complex": null, "simple": "assigned_user_pretty_name" }, "XDR Description": { "complex": null, "simple": "description" }, "XDR Detection Time": { "complex": { "accessor": "", "filters": [], "root": "detection_time", "transformers": [ { "args": {}, "operator": "TimeStampToDate" } ] }, "simple": "" }, "XDR High Severity Alert Count": { "complex": null, "simple": "high_severity_alert_count" }, "XDR Host Count": { "complex": null, "simple": "host_count" }, "XDR Incident ID": { "complex": null, "simple": "incident_id" }, "XDR Low Severity Alert Count": { "complex": null, "simple": "low_severity_alert_count" }, "XDR Medium Severity Alert Count": { "complex": null, "simple": "med_severity_alert_count" }, "XDR Notes": { "complex": null, "simple": "notes" }, "XDR Resolve Comment": { "complex": null, "simple": "resolve_comment" }, "XDR Starred": { "complex": null, "simple": "starred" }, "XDR Status": { "complex": null, "simple": "status" }, "XDR Status v2": { "complex": null, "simple": "status" }, "XDR URL": { "complex": null, "simple": "xdr_url" }, "XDR User Count": { "complex": null, "simple": "user_count" }, "occurred": { "complex": { "accessor": "", "filters": [], "root": "creation_time", "transformers": [ { "args": {}, "operator": "TimeStampToDate" } ] }, "simple": "" }, "severity": { "complex": { "filters": [], "root": "severity", "transformers": [ { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "1" } }, "toReplace": { "isContext": false, "value": { "simple": "low" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "2" } }, "toReplace": { "isContext": false, "value": { "simple": "medium" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "3" } }, "toReplace": { "isContext": false, "value": { "simple": "high" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "4" } }, "toReplace": { "isContext": false, "value": { "simple": "critical" } } }, "operator": "replace" } ] } } } }, "Malware Investigation and Response": { "dontMapEventToLabels": true, "internalMapping": { "Additional Data": { "simple": "alerts" }, "Agent Version": { "complex": { "accessor": "agentversion", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Agents ID": { "simple": "alerts.endpoint_id" }, "CMD line": { "simple": "alerts.action_process_image_command_line" }, "Description": { "simple": "description" }, "Detected User": { "complex": { "accessor": "user_name", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Device Internal IPs": { "simple": "alerts.host_ip" }, "Device Local IP": { "simple": "alerts.[0].host_ip" }, "Device OS Name": { "complex": { "accessor": "agent_os_type", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Device OS Version": { "complex": { "accessor": "agent_os_sub_type", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "External Category Name": { "simple": "alerts.category" }, "External End Time": { "simple": "modification_time" }, "External Link": { "simple": "xdr_url" }, "External Start Time": { "simple": "creation_time" }, "External Status": { "simple": "status" }, "External System ID": { "simple": "incident_id" }, "File Names": { "simple": "alerts.action_file_name" }, "File Paths": { "simple": "alerts.action_file_path" }, "File SHA256": { "simple": "file_artifacts.filesha256" }, "Hostnames": { "complex": { "accessor": "host_name", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "LastMirroredInTime": { "complex": { "filters": [], "root": "last_mirrored_in", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "MITRE Tactic ID": { "simple": "mitre_tactics_ids_and_names" }, "MITRE Tactic Name": { "simple": "mitre_tactics_ids_and_names" }, "MITRE Technique ID": { "simple": "mitre_techniques_ids_and_names" }, "MITRE Technique Name": { "simple": "mitre_techniques_ids_and_names" }, "OutgoingMirrorError": { "simple": "out_mirror_error" }, "Parent CMD line": { "simple": "alerts.causality_actor_process_command_line" }, "Parent Process CMD": { "simple": "alerts.causality_actor_process_command_line" }, "Parent Process MD5": { "simple": "alerts.causality_actor_process_image_md5" }, "Parent Process Name": { "simple": "alerts.causalityactorprocessimagename" }, "Parent Process SHA256": { "simple": "alerts.causality_actor_process_image_sha256" }, "Process CMD": { "simple": "alerts.actor_process_command_line" }, "Process MD5": { "simple": "alerts.actor_process_image_md5" }, "Process Names": { "complex": { "accessor": "actor_process_image_name", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Process Paths": { "complex": { "accessor": "actor_process_image_path", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Process SHA256": { "simple": "alerts.actor_process_image_sha256" }, "Source IPs": { "complex": { "accessor": "host_ip", "filters": [], "root": "alerts", "transformers": [ { "operator": "uniq" } ] } }, "Users": { "simple": "users" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "incident_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "occurred": { "complex": { "filters": [], "root": "creation_time", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "owner": { "simple": "owner" }, "severity": { "complex": { "filters": [], "root": "severity", "transformers": [ { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "1" } }, "toReplace": { "isContext": false, "value": { "simple": "low" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "2" } }, "toReplace": { "isContext": false, "value": { "simple": "medium" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "3" } }, "toReplace": { "isContext": false, "value": { "simple": "high" } } }, "operator": "replace" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "4" } }, "toReplace": { "isContext": false, "value": { "simple": "critical" } } }, "operator": "replace" } ] } } } } } }