CrowdStrike Falcon Mapper
CrowdStrike Falcon Mapper for incidents and detections
CrowdStrike Falcon Mapper (In)
Details
| ID | CrowdStrike Falcon-Mapper |
|---|---|
| Type | mapping-incoming |
| Version | -1 |
| From Version | 6.0.0 |
| To Version | 6.4.9 |
| Default Incident Type | — |
| Feed | No |
{ "description": "CrowdStrike Falcon Mapper for incidents and detections", "feed": false, "id": "CrowdStrike Falcon-Mapper", "mapping": { "CrowdStrike Falcon Mobile Detection": { "dontMapEventToLabels": true, "internalMapping": { "Agent ID": { "simple": "agent_id" }, "State": { "simple": "status" }, "CrowdStrike Falcon Crawled Timestamp": { "simple": "crawled_timestamp" }, "CrowdStrike Falcon Detection Type": { "simple": "type" }, "CrowdStrike Falcon Firmware Build Fingerprint": { "simple": "firmware_build_fingerprint" }, "CrowdStrike Falcon Firmware Build Time": { "simple": "firmware_build_time" }, "Behaviour Objective": { "simple": "objective" }, "Behaviour Scenario": { "simple": "scenario" }, "Behaviour Tactic": { "simple": "tactic" }, "CrowdStrike Falcon Mobile Manufacturer": { "simple": "mobile_manufacturer" }, "CrowdStrike Falcon Mobile Product": { "simple": "mobile_product" }, "CrowdStrike Falcon Mobile platform version": { "simple": "platform_version" }, "CrowdStrike Falcon Security patch level": { "simple": "security_patch_level" }, "Description": { "simple": "description" }, "Device Name": { "simple": "computer_name" }, "External Confidence": { "simple": "confidence" }, "Mobile Device Model": { "simple": "mobile_model" }, "OS": { "simple": "platform" }, "OS Version": { "simple": "os_version" }, "Tactic ID": { "simple": "tactic_id" }, "Technique": { "simple": "technique" }, "Technique ID": { "simple": "tactic_id" }, "Threat Name": { "simple": "name" }, "occurred": { "simple": "created_timestamp" }, "severity": { "simple": "severity" }, "Display Name": { "simple": "display_name" }, "Email": { "simple": "enrollment_email" }, "Detection ID": { "simple": "mobile_detection_id" }, "Vendor Product": { "simple": "product" }, "Last Update Time": { "simple": "updated_timestamp" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "name": { "simple": "mobile_detection_id" } } }, "CrowdStrike Falcon IOA Event": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "simple": "extracted_account_id" }, "occurred": { "simple": "event_created" }, "severity": { "simple": "severity" }, "CrowdStrike Falcon Service Type": { "simple": "service" }, "Cloud Region List": { "simple": "cloud_region" }, "CrowdStrike Falcon Vertex ID": { "simple": "vertex_id" }, "CrowdStrike Falcon Vertex Type": { "simple": "vertex_type" }, "Event ID": { "simple": "event_id" }, "Event Names": { "simple": "event_name" }, "Event Type": { "simple": "event_type" }, "External ID": { "simple": "request_id" }, "Source IP": { "simple": "source_ip_address" }, "CrowdStrike Falcon User Agent": { "simple": "user_agent" }, "CrowdStrike Falcon Request Parameters": { "simple": "request_parameters" }, "CrowdStrike Falcon Response Elements": { "simple": "response_elements" }, "CrowdStrike Falcon User Identity": { "simple": "user_identity" }, "Risk Score": { "simple": "aggregate.score" }, "CrowdStrike Falcon Enrichments": { "simple": "enrichments" }, "UUID": { "simple": "extracted_uuid" }, "Resource ID": { "simple": "extracted_resource_id" }, "Cloud Service": { "simple": "event_source" }, "Source Create time": { "simple": "event_created" }, "Policy ID": { "simple": "policy_id" }, "Policy Description": { "simple": "policy_statement" }, "Policy Type": { "simple": "policy_type" }, "State": { "simple": "state" }, "Last Update Time": { "simple": "updated_timestamp" }, "name": { "complex": { "filters": [], "root": "composite_id", "transformers": [ { "args": { "prefix": { "isContext": false, "value": { "simple": "Indicator of Attack ID: " } }, "suffix": { "isContext": false } }, "operator": "concat" } ] } }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon IOM Event": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "simple": "account_id" }, "occurred": { "simple": "report_date_time" }, "severity": { "simple": "severity" }, "Account Name": { "simple": "account_name" }, "Policy ID": { "simple": "policy_id" }, "Policy Description": { "simple": "policy_statement" }, "Policy Type": { "simple": "policy_type" }, "Region": { "simple": "region" }, "Start Time": { "simple": "report_date_time" }, "CrowdStrike Falcon Resource Attributes": { "simple": "resource_attributes" }, "Source Create time": { "simple": "resource_create_time" }, "Resource ID": { "simple": "resource_id" }, "Resource Type": { "simple": "resource_id_type" }, "External Link": { "simple": "resource_url" }, "Cloud Service": { "simple": "cloud_provider" }, "State": { "simple": "status" }, "Tags": { "simple": "tags" }, "name": { "simple": "id" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon IDP Detection": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "simple": "source_endpoint_account_object_guid" }, "Account Name": { "simple": "source_account_name" }, "Behaviour Objective": { "simple": "objective" }, "Behaviour Scenario": { "simple": "scenario" }, "Behaviour Tactic": { "simple": "tactic" }, "CrowdStrike Falcon Crawled Timestamp": { "simple": "crawled_timestamp" }, "CrowdStrike Falcon Detection Type": { "simple": "type" }, "Display Name": { "simple": "display_name" }, "Description": { "simple": "description" }, "End Time": { "simple": "end_time" }, "External Confidence": { "simple": "confidence" }, "Last Update Time": { "simple": "updated_timestamp" }, "OS": { "simple": "platform" }, "CrowdStrike Falcon Pattern ID": { "simple": "pattern_id" }, "Source Hostname": { "simple": "source_endpoint_host_name" }, "Src NT Domain": { "simple": "source_account_domain" }, "Start Time": { "simple": "start_time" }, "State": { "simple": "status" }, "Tactic ID": { "simple": "tactic_id" }, "Technique": { "simple": "technique" }, "Technique ID": { "simple": "technique_id" }, "Threat Name": { "simple": "name" }, "Vendor Product": { "simple": "product" }, "name": { "simple": "composite_id" }, "occurred": { "simple": "created_timestamp" }, "sAMAccountName": { "simple": "source_account_sam_account_name" }, "severity": { "simple": "severity" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon On-Demand Scans Detection": { "dontMapEventToLabels": false, "internalMapping": { "Alert ID": { "simple": "composite_id" }, "Behaviour Objective": { "simple": "objective" }, "Behaviour Tactic": { "simple": "tactic" }, "CrowdStrike Falcon Platform Name": { "simple": "device.platform_name" }, "CrowdStrike Falcon Product Type Description": { "simple": "device.product_type_desc" }, "CrowdStrike Falcon System Manufacturer": { "simple": "device.system_manufacturer" }, "CrowdStrike Falcon System Product Name": { "simple": "device.system_product_name" }, "CrowdStrike Falcon Scan Name": { "simple": "name" }, "CrowdStrike Falcon Scan Id": { "simple": "scan_id" }, "CrowdStrike Falcon Pattern ID":{ "simple": "pattern_id" }, "Tactic ID": { "simple": "tactic_id" }, "Technique": { "simple": "technique" }, "Technique ID": { "simple": "technique_id" }, "Device External IP": { "simple": "device.external_ip" }, "Device Local IP": { "simple": "device.local_ip" }, "MAC Address": { "simple": "device.mac_address" }, "OS": { "simple": "device.os_version" }, "Device Name": { "simple": "device.hostname" }, "Cloud Instance ID": { "simple": "device.instance_id" }, "Agent Version": { "simple": "device.agent_version" }, "Cloud Service": { "simple": "service_provider" }, "Cloud Account ID": { "simple": "service_provider_account_id" }, "Last Update Time": { "simple": "timestamp" }, "Display Name":{ "simple": "display_name" }, "Device Id": { "simple": "device.device_id" }, "Event ID": { "simple": "event_id" }, "File Name": { "simple": "filename" }, "File Path": { "simple": "filepath" }, "Vendor Product": { "simple": "product" }, "severity": { "simple": "severity" }, "SHA256": { "simple": "sha256" }, "CrowdStrike Falcon Detection Type": { "simple": "type" }, "State": { "simple": "status" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon OFP Detection": { "dontMapEventToLabels": false, "internalMapping": { "Agent ID": { "simple": "agent_id" }, "CrowdStrike Falcon Alleged File Type": { "simple": "alleged_filetype" }, "CMD line": { "simple": "cmdline" }, "severity": { "simple": "severity" }, "occurred": { "simple": "created_timestamp" }, "External Confidence": { "simple": "confidence" }, "CrowdStrike Falcon Crawled Timestamp": { "simple": "crawled_timestamp" }, "Description": { "simple": "description" }, "CrowdStrike Falcon Data Domains": { "simple": "data_domains" }, "OS Version": { "simple": "os_version" }, "Cloud Instance ID": { "simple": "device.instance_id" }, "Device Name": { "simple": "device.hostname" }, "Agent Version": { "simple": "device.agent_version" }, "CrowdStrike Falcon Bios Manufacturer": { "simple": "device.bios_manufacturer" }, "CrowdStrike Falcon Bios Version": { "simple": "device.bios_version" }, "Device Id": { "simple": "device.device_id" }, "Device External IP": { "simple": "device.external_ip" }, "First Seen": { "simple": "device.first_seen" }, "Last Seen": { "simple": "device.last_seen" }, "Device Local IP": { "simple": "device.local_ip" }, "Device MAC Address": { "simple": "device.mac_address" }, "Device OS Version": { "simple": "device.os_version" }, "CrowdStrike Falcon Platform Name": { "simple": "device.platform_name" }, "CrowdStrike Falcon Product Type Description": { "simple": "device.product_type_desc" }, "Cloud Service": { "simple": "service_provider" }, "Cloud Account ID": { "simple": "device.service_provider_account_id" }, "CrowdStrike Falcon System Manufacturer": { "simple": "device.system_manufacturer" }, "Display Name":{ "simple": "display_name" }, "File Name": { "simple": "filename" }, "File Path": { "simple": "filepath" }, "CrowdStrike Falcon Macros CMD line": { "simple": "macros.cmdline" }, "CrowdStrike Falcon Macros Display Name": { "simple": "macros.display_name" }, "CrowdStrike Falcon Macros IOC Description": { "simple": "macros.ioc_description" }, "CrowdStrike Falcon Macros IOC Source": { "simple": "macros.ioc_source" }, "CrowdStrike Falcon Macros IOC Type": { "simple": "macros.ioc_type" }, "MD5": { "simple": "md5" }, "Threat Name": { "simple": "name" }, "Behaviour Objective": { "simple": "objective" }, "Parent CMD line": { "simple": "parent_details.cmdline" }, "Parent Process File Path": { "simple": "parent_details.filepath" }, "Parent Process MD5": { "simple": "parent_details.md5" }, "Parent Process SHA256": { "simple": "parent_details.sha256" }, "Parent Process IDs": { "simple": "parent_process_id" }, "CrowdStrike Falcon Pattern ID":{ "simple": "pattern_id" }, "OS": { "simple": "platform" }, "Vendor Product": { "simple": "product" }, "Behaviour Scenario": { "simple": "scenario" }, "Process ID": { "simple": "process_id" }, "State": { "simple": "status" }, "Behaviour Tactic": { "simple": "tactic" }, "Tactic ID": { "simple": "tactic_id" }, "Technique": { "simple": "technique" }, "Technique ID": { "simple": "technique_id" }, "CrowdStrike Falcon Detection Type": { "simple": "type" }, "Last Update Time": { "simple": "updated_timestamp" }, "User Id": { "simple": "user_id" }, "Username": { "simple": "user_name" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon Detection": { "dontMapEventToLabels": true, "internalMapping": { "Account Name": { "simple": "user_name" }, "Agent Version": { "simple": "device.agent_version" }, "Alert ID": { "simple": "composite_id" }, "Assigned User": { "simple": "assigned_to_uid" }, "CrowdStrike Falcon Behaviour Pattern Disposition Details": { "complex": { "filters": [], "root": "pattern_disposition_details", "transformers": [ { "operator": "ConvertKeysToTableFieldFormat" } ] } }, "Behaviour Objective": { "simple": "objective" }, "Behaviour Scenario": { "simple": "scenario" }, "Behaviour Tactic": { "simple": "tactic" }, "Technique": { "simple": "technique" }, "CMD line": { "simple": "cmdline" }, "Cloud Instance ID": { "simple": "device.instance_id" }, "Cloud Service": { "simple": "device.service_provider" }, "Description": { "simple": "description" }, "Detected User": { "simple": "user_name" }, "Device External IP": { "simple": "device.external_ip" }, "Device Local IP": { "simple": "device.local_ip" }, "Device Model": { "simple": "device.platform_name" }, "Device Name": { "simple": "device.hostname" }, "Event Descriptions": { "simple": "description" }, "Event Names": { "simple": "display_name" }, "File MD5": { "simple": "md5" }, "File Name": { "simple": "filename" }, "File Paths": { "simple": "filepath" }, "File SHA256": { "simple": "sha256" }, "Hostnames": { "simple": "device.hostname" }, "Last Update Time": { "simple": "timestamp" }, "MAC Address": { "simple": "device.mac_address" }, "MD5": { "simple": "md5" }, "OS": { "simple": "device.os_version" }, "Parent CMD line": { "simple": "parent_details.cmdline" }, "SHA256": { "simple": "sha256" }, "Start Time": { "simple": "first_behavior" }, "State": { "simple": "status" }, "name": { "complex": { "filters": [], "root": "display_name", "transformers": [ { "args": { "prefix": { "isContext": false, "value": { "simple": "Falcon Detection - " } }, "suffix": { "isContext": false, "value": { "simple": " - Detection ID: " } } }, "operator": "concat" }, { "args": { "prefix": {}, "suffix": { "isContext": true, "value": { "simple": "composite_id" } } }, "operator": "concat" } ] } }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon Incident": { "dontMapEventToLabels": false, "internalMapping": { "Agent Version": { "simple": "hosts.agent_version" }, "Agents ID": { "simple": "hosts.device_id" }, "Assigned User": { "simple": "assigned_to_name" }, "DNS Name": { "simple": "hosts.site_name" }, "Detected User": { "simple": "users" }, "Device External IP": { "simple": "hosts.external_ip" }, "Device Local IP": { "simple": "hosts.local_ip" }, "Device Model": { "simple": "hosts.platform_name" }, "Device Name": { "simple": "hosts.hostname" }, "Device OU": { "simple": "hosts.ou" }, "Hostnames": { "simple": "hosts.hostname" }, "Last Update Time": { "simple": "end" }, "MAC Address": { "simple": "hosts.mac_address" }, "OS": { "simple": "hosts.os_version" }, "Objective": { "simple": "objectives" }, "Src NT Domain": { "simple": "hosts.machine_domain" }, "Start Time": { "simple": "start" }, "State": { "simple": "state" }, "Tactic": { "simple": "tactics" }, "Technique": { "simple": "techniques" }, "Users": { "simple": "users" }, "name": { "complex": { "filters": [], "root": "incident_id", "transformers": [ { "args": { "prefix": { "value": { "simple": "Falcon Incident - ID: " } }, "suffix": {} }, "operator": "concat" } ] } }, "severity": { "complex": { "filters": [], "root": "fine_score", "transformers": [ { "args": { "map_from": { "value": { "simple": "1-24,25-49,50-74,75-100" } }, "map_to": { "value": { "simple": "1,2,3,4" } }, "sep": {} }, "operator": "MapRangeValues" } ] } }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "incident_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "Malware": { "dontMapEventToLabels": false, "internalMapping": { "Agents ID": { "complex": { "accessor": "device_id", "filters": [], "root": "device", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "host_ids" } } }, "operator": "append" } ] } } } }, "dbot_classification_incident_type_all": { "dontMapEventToLabels": false, "internalMapping": { "Policy Actions": { "simple": "pattern_disposition_details" }, "Agent Version": { "simple": "device.agent_version" }, "Agents ID": { "complex": { "accessor": "device_id", "filters": [], "root": "device", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "hosts.device_id" } } }, "operator": "append" } ] } }, "CMD line": { "simple": "cmdline" }, "Description": { "simple": "description" }, "Device External IPs": { "complex": { "accessor": "external_ip", "filters": [], "root": "device", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "hosts.external_ip" } } }, "operator": "append" } ] } }, "Device Id": { "simple": "device.device_id" }, "Device Internal IPs": { "complex": { "accessor": "local_ip", "filters": [], "root": "device", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "hosts.local_ip" } } }, "operator": "append" } ] } }, "Device MAC Address": { "complex": { "accessor": "mac_address", "filters": [], "root": "device", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "hosts.mac_address" } } }, "operator": "append" } ] } }, "Device OS Name": { "complex": { "accessor": "platform_name", "filters": [], "root": "device", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "hosts.platform_name" } } }, "operator": "append" } ] } }, "Device OS Version": { "complex": { "accessor": "os_version", "filters": [], "root": "device", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "hosts.os_version" } } }, "operator": "append" } ] } }, "External Category Name": { "simple": "incident_type" }, "External Confidence": { "simple": "confidence" }, "External ID": { "complex": { "filters": [], "root": "incident_id", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "composite_id" } } }, "operator": "append" } ] } }, "External Link": { "complex": { "filters": [], "root": "composite_id", "transformers": [ { "args": { "from": { "isContext": false, "value": { "simple": ":" } } }, "operator": "substringFrom" }, { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "/" } }, "toReplace": { "isContext": false, "value": { "simple": ":" } } }, "operator": "replace" }, { "args": { "prefix": { "isContext": false, "value": { "simple": "https://falcon.crowdstrike.com/activity/detections/detail/" } }, "suffix": { "isContext": false } }, "operator": "concat" } ] } }, "External Severity": { "complex": { "filters": [], "root": "severity", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "fine_score" } } }, "operator": "append" } ] } }, "External Status": { "simple": "status" }, "External System ID": { "complex": { "filters": [], "root": "composite_id", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "incident_id" } } }, "operator": "append" }, { "operator": "uniq" } ] } }, "File MD5": { "simple": "md5" }, "File Names": { "simple": "filename" }, "File Paths": { "simple": "filepath" }, "File SHA256": { "simple": "sha256" }, "Grand Parent Process": { "complex": { "filters": [], "root": "grandparent_details", "transformers": [] } }, "Hostnames": { "complex": { "accessor": "hostname", "filters": [], "root": "device", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "hosts.hostname" } } }, "operator": "append" }, { "operator": "uniq" } ] } }, "MITRE Tactic ID": { "simple": "tactic_id" }, "MITRE Tactic Name": { "simple": "tactic" }, "MITRE Technique ID": { "simple": "technique_id" }, "MITRE Technique Name": { "simple": "technique" }, "PID": { "simple": "local_process_id" }, "Parent CMD line": { "simple": "parent_details.cmdline" }, "Parent Process": { "simple": "parent_details" }, "Parent Process CMD": { "simple": "parent_details.cmdline" }, "Parent Process File Path": { "simple": "parent_details.filepath" }, "Parent Process IDs": { "simple": "parent_details.local_process_id" }, "Parent Process MD5": { "simple": "parent_details.md5" }, "Parent Process Name": { "simple": "parent_details.filename" }, "Parent Process Path": { "simple": "parent_details.filepath" }, "Parent Process SHA256": { "simple": "parent_details.sha256" }, "Process CMD": { "simple": "parent_details.cmdline" }, "Process ID": { "simple": "local_process_id" }, "Process MD5": { "simple": "md5" }, "Process SHA256": { "simple": "sha256" }, "Scenario": { "simple": "scenario" }, "Source MAC Address": { "simple": "device.mac_address" }, "Tactic": { "simple": "tactic" }, "Tactic ID": { "simple": "tactic_id" }, "Tags": { "simple": "tags" }, "Technique": { "simple": "technique" }, "Technique ID": { "simple": "technique_id" }, "Users": { "simple": "user_name" }, "name": { "complex": { "accessor": "}", "filters": [], "root": "${", "transformers": [ { "args": { "conditions": { "isContext": false, "value": { "simple": "[\n {\n \"condition\": \"#{incident_type} == 'ngsiem_case'\",\n \"return\": \"NGSIEM Case - ID: \" + #{id}\n },\n {\n \"condition\": \"#{incident_type} == 'detection'\",\n \"return\": \"Falcon Detection - \" + #{display_name} + \" - Detection ID: \" + #{composite_id}\n },\n {\n \"condition\": \"#{incident_type} == 'incident'\",\n \"return\": \"Falcon Incident - ID: \" + #{incident_id}\n },\n {\n \"condition\": \"#{incident_type} == 'IDP detection'\",\n \"return\": #{id}\n },\n {\n \"condition\": \"#{incident_type} == 'iom_configurations'\",\n \"return\": #{id}\n },\n {\n \"condition\": \"#{incident_type} == 'MOBILE detection'\",\n \"return\": #{mobile_detection_id}\n },\n {\n \"condition\": \"#{incident_type} == 'ioa_detection'\",\n \"return\": \"Indicator of Attack ID: \" + #{composite_id}\n },\n {\n \"condition\": \"#{incident_type} == 'On-Demand Scans detection'\",\n \"return\": #{incident_type} + \" - \" + #{composite_id}\n },\n{\n \"condition\": \"#{incident_type} == 'OFP detection'\",\n \"return\": #{incident_type} + \" - \" + #{composite_id}\n },\n{\n \"condition\": \"#{incident_type} == 'ngsiem_detection'\",\n \"return\": #{incident_type} + \" - \" + #{composite_id}\n },\n{\n \"condition\": \"#{incident_type} == 'thirdparty_detection'\",\n \"return\": #{incident_type} + \" - \" + #{composite_id}\n },\n{\n \"condition\": \"#{device\\.hostname} != None\",\n \"return\": #{incident_type} + \" - \" + #{composite_id} + \" - \" + #{device\\.hostname}\n },\n {\n \"condition\": \"#{hosts\\.hostname} != None\",\n \"return\": #{incident_type} + \" - \" + #{incident_id} + \" - \" + #{hosts\\.hostname}\n },\n {\n \"condition\": \"#{incident_id} != None\",\n \"return\": #{incident_type} + \" - \" + #{incident_id}\n },\n {\n \"condition\": \"#{composite_id} != None\",\n \"return\": #{incident_type} + \" - \" + #{composite_id}\n },\n {\n \"condition\": \"#{incident_type} == 'Recon notifications'\",\n \"return\": #{id}\n },\n {\n \"default\": #{incident_type}\n }\n]" } }, "flags": { "isContext": false } }, "operator": "If-Elif" } ] } }, "severity": { "complex": { "filters": [], "root": "fine_score", "transformers": [ { "args": { "item": { "isContext": true, "value": { "simple": "severity" } } }, "operator": "append" }, { "args": { "map_from": { "isContext": false, "value": { "simple": "0-20,21-40,41-60,61-80,81-100" } }, "map_to": { "isContext": false, "value": { "simple": "Informational,Low,Medium,High,Critical" } }, "sep": { "isContext": false } }, "operator": "MapRangeValues" } ] } } } }, "CrowdStrike Falcon Third Party Detection": { "dontMapEventToLabels": false, "internalMapping": { "Behaviour Tactic": { "simple": "tactic" }, "CrowdStrike Falcon Crawled Timestamp": { "simple": "crawled_timestamp" }, "CrowdStrike Falcon Detection Type": { "simple": "type" }, "CrowdStrike Falcon Pattern ID": { "simple": "pattern_id" }, "Display Name": { "simple": "display_name" }, "Domain Name": { "simple": "data_domains" }, "Last Update Time": { "simple": "updated_timestamp" }, "Source IP": { "simple": "source_endpoint_address_ip4" }, "State": { "simple": "status" }, "Tags": { "simple": "tags" }, "Threat Name": { "simple": "name" }, "User SID": { "simple": "user_sid" }, "Vendor Product": { "simple": "product" }, "occurred": { "simple": "created_timestamp" }, "severity": { "simple": "severity" }, "User Id": { "simple": "user_id" }, "Username": { "simple": "user_name" }, "Source IPV6": { "simple": "source_endpoint_address_ip6" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon NGSIEM Detection": { "dontMapEventToLabels": false, "internalMapping": { "occurred": { "simple": "created_timestamp" }, "severity": { "simple": "severity" }, "CrowdStrike Falcon Crawled Timestamp": { "simple": "crawled_timestamp" }, "Description": { "simple": "description" }, "Domain Name": { "simple": "data_domains" }, "Display Name": { "simple": "display_name" }, "Destination IPs": { "simple": "destination_ips" }, "End Time": { "simple": "end_time" }, "Threat Name": { "simple": "name" }, "CrowdStrike Falcon Pattern ID": { "simple": "pattern_id" }, "Vendor Product": { "simple": "product" }, "Source IPs": { "simple": "source_ips" }, "Start Time": { "simple": "start_time" }, "State": { "simple": "status" }, "Tactic ID": { "simple": "tactic_id" }, "Behaviour Tactic": { "simple": "tactic" }, "Last Update Time": { "simple": "updated_timestamp" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon NGSIEM Case": { "dontMapEventToLabels": false, "internalMapping": { "Additional Email Addresses": { "simple": "last_updated_by.email" }, "Assigned User": { "simple": "assigned_to" }, "Description": { "simple": "description" }, "Email": { "simple": "created_by.email" }, "End Time": { "simple": "end_timestamp" }, "External Category Name": { "simple": "incident_type" }, "External System ID": { "simple": "id" }, "Full Name": { "simple": "last_updated_by.full_name" }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "Last Update Time": { "simple": "updated_timestamp" }, "Source Created By": { "simple": "created_by.full_name" }, "Start Time": { "simple": "start_timestamp" }, "State": { "simple": "status" }, "Threat Name": { "simple": "name" }, "UUID": { "simple": "created_by.uuid" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "complex": { "filters": [], "root": "id", "transformers": [ { "args": { "prefix": { "isContext": false, "value": { "simple": ":case:" } }, "suffix": { "isContext": false } }, "operator": "concat" } ] } }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "occurred": { "simple": "created_timestamp" }, "severity": { "simple": "severity" } } }, "CrowdStrike Falcon NGSIEM Automated Lead":{ "dontMapEventToLabels": false, "internalMapping": { "Agent ID": { "simple": "agent_id" }, "CrowdStrike Falcon Crawled Timestamp": { "simple": "crawled_timestamp" }, "Device Id": { "simple": "device.device_id" }, "Display Name": { "simple": "display_name" }, "Last Update Time": { "simple": "updated_timestamp" }, "CrowdStrike Falcon Lead Id": { "simple": "lead_id" }, "CrowdStrike Falcon Lead Type": { "simple": "lead_type" }, "Risk Score": { "simple": "score" }, "State": { "simple": "status" }, "Vendor Product": { "simple": "product" }, "occurred": { "simple": "created_timestamp" }, "CrowdStrike Falcon Pattern ID": { "simple": "mitre_attack.pattern_id" }, "MITRE Tactic ID": { "simple": "mitre_attack.tactic_id" }, "MITRE Tactic Name": { "simple": "mitre_attack.tactic" }, "MITRE Technique ID": { "simple": "mitre_attack.technique_id" }, "MITRE Technique Name": { "simple": "mitre_attack.technique" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon NGSIEM Incident": { "dontMapEventToLabels": false, "internalMapping": { "Agents ID": { "simple": "entities.agent_ids" }, "CrowdStrike Falcon Crawled Timestamp": { "simple": "crawled_timestamp" }, "CrowdStrike Falcon Data Domains": { "simple": "data_domains" }, "CrowdStrike Falcon Pattern ID": { "simple": "pattern_id" }, "CrowdStrike Falcon Platform Name": { "simple": "platform" }, "CrowdStrike Falcon System Product Name": { "simple": "product" }, "Detected External Hosts": { "simple": "entities.host" }, "Detection ID": { "simple": "xdr_detection_id" }, "End Time": { "simple": "end_time" }, "Last Update Time": { "simple": "updated_timestamp" }, "CrowdStrike Falcon Mitre Attack": { "simple": "mitre_attack" }, "Source IPs": { "simple": "entities.ip_source" }, "Start Time": { "simple": "start_time" }, "State": { "simple": "status" }, "occurred": { "simple": "created_timestamp" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "composite_id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } }, "CrowdStrike Falcon Intelligence Recon notification": { "dontMapEventToLabels": false, "internalMapping": { "CrowdStrike Falcon Actor slug": { "simple": "notification.actor_slug" }, "CrowdStrike Falcon Item author": { "simple": "notification.item_author" }, "CrowdStrike Falcon Item Author ID": { "simple": "notification.item_author_id" }, "CrowdStrike Falcon Item date": { "simple": "notification.item_date" }, "CrowdStrike Falcon Item id": { "simple": "notification.item_id" }, "CrowdStrike Falcon Item site": { "simple": "notification.item_site" }, "CrowdStrike Falcon Item site ID": { "simple": "notification.item_site_id" }, "CrowdStrike Falcon Item type": { "simple": "notification.item_type" }, "CrowdStrike Falcon Role ID": { "simple": "notification.rule_id" }, "CrowdStrike Falcon Role creator name": { "simple": "notification.rule_creator_name" }, "CrowdStrike Falcon Role creator UID": { "simple": "notification.rule_creator_uid" }, "CrowdStrike Falcon Role priority": { "simple": "notification.rule_priority" }, "CrowdStrike Falcon Role topic": { "simple": "notification.rule_topic" }, "Last Update Time": { "simple": "notification.updated_date" }, "Rule Name": { "simple": "notification.rule_name" }, "Source Category": { "simple": "notification.source_category" }, "State": { "simple": "notification.status" }, "name": { "simple": "id" }, "occurred": { "simple": "notification.created_date" }, "severity": { "simple": "severity" }, "CrowdStrike Falcon At Accounts": { "simple": "details.iocs.at_accounts" }, "CrowdStrike Falcon IOC CVES": { "simple": "details.iocs.cves" }, "CrowdStrike Falcon IOC Domains": { "simple": "details.ioc.domains" }, "CrowdStrike Falcon IOC Emails": { "simple": "details.ioc.emails" }, "CrowdStrike Falcon IOC Hashtags": { "simple": "details.ioc.hashtags" }, "CrowdStrike Falcon IOC Types": { "simple": "details.ioc_types" }, "CrowdStrike Falcon IOC Urls": { "simple": "details.ioc.urls" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "complex": { "filters": [], "root": "id", "transformers": [ { "args": { "prefix": { "isContext": false, "value": { "simple": ":recon:" } }, "suffix": { "isContext": false } }, "operator": "concat" } ] } }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "IncomingMirrorError": { "simple": "in_mirror_error" } } } }, "name": "CrowdStrike Falcon Mapper", "type": "mapping-incoming", "version": -1, "fromVersion": "6.5.0", "marketplaces": [ "xsoar" ] }