Elasticsearch Security Alert - Incoming Mapper

Maps incoming Elasticsearch Security Alert fields to XSOAR incident fields.

Elasticsearch Mapper (In)

Details

IDElasticsearch Security Alert - Incoming Mapper
Typemapping-incoming
Version-1
From Version6.2.0
Default Incident Type—
FeedNo

Source

classifier-Elasticsearch_Security_Alert_Incoming_Mapper.json
Download History Raw 
{
    "description": "Maps incoming Elasticsearch Security Alert fields to XSOAR incident fields.",
    "feed": false,
    "id": "Elasticsearch Security Alert - Incoming Mapper",
    "mapping": {
        "Elasticsearch Security Alert": {
            "dontMapEventToLabels": true,
            "internalMapping": {
                "dbotMirrorDirection": {
                    "complex": null,
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "complex": null,
                    "simple": "mirror_id"
                },
                "dbotMirrorInstance": {
                    "complex": null,
                    "simple": "mirror_instance"
                },
                "dbotMirrorLastSync": {
                    "complex": null,
                    "simple": "kibana.alert.updated_at"
                },
                "Elasticsearch Workflow Alert Status": {
                    "simple": "kibana.alert.workflow_status"
                },
                "Elasticsearch Workflow Alert Status Reason": {
                    "simple": "kibana.alert.workflow_reason"
                },
                "Elasticsearch Alert Reason": {
                    "simple": "kibana.alert.reason"
                },
                "severity": {
                    "simple": "severity"
                },
                "Elasticsearch Status Update Date": {
                    "simple": "kibana.alert.workflow_status_updated_at"
                },
                "Elasticsearch Timestamp": {
                    "simple": "@timestamp"
                },
                "Tags": {
                    "simple": "kibana.alert.workflow_tags"
                },
                "Risk Score": {
                    "simple": "kibana.alert.risk_score"
                },
                "Elasticsearch index": {
                    "simple": "_index"
                },
                "Elasticsearch Alert ID": {
                    "simple": "kibana.alert.uuid"
                }
            }
        }
    },
    "name": "Elasticsearch Security Alert - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.2.0",
    "supportedModules": [
        "agentix",
        "xsiam"
    ]
}