Elasticsearch

Classifies Elasticsearch entities using the deterministic 'elastic_entity_kind' field set by the integration on every fetched incident: 'signal' is classified as Elasticsearch Security Alert, 'securitySolution' is classified as Elasticsearch Case, and any other value falls back to the default Elasticsearch incident type.

Elasticsearch Classification

Details

ID	`Elasticsearch`
Type	classification
Version	-1
From Version	6.2.0
Default Incident Type	Elasticsearch
Feed	No

Key Type Map

Key	Incident Type
`signal`	Elasticsearch Security Alert
`securitySolution`	Elasticsearch Case

Source

classifier-Elasticsearch.json classifier-Elasticsearch_-_Incoming_Mapper.json classifier-Elasticsearch_Case_Incoming_Mapper.json classifier-Elasticsearch_Case_Outgoing_Mapper.json classifier-Elasticsearch_Security_Alert_Incoming_Mapper.json classifier-Elasticsearch_Security_Alert_Outgoing_Mapper.json

Download History Raw

{
    "description": "Maps incoming Elasticsearch Case fields to XSOAR incident fields.",
    "feed": false,
    "id": "Elasticsearch Case - Incoming Mapper",
    "mapping": {
        "Elasticsearch Case": {
            "dontMapEventToLabels": true,
            "internalMapping": {
                "dbotMirrorDirection": {
                    "complex": null,
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "complex": null,
                    "simple": "mirror_id"
                },
                "dbotMirrorInstance": {
                    "complex": null,
                    "simple": "mirror_instance"
                },
                "name": {
                    "simple": "title"
                },
                "details": {
                    "simple": "description"
                },
                "Owner": {
                    "simple": "owner"
                },
                "Category": {
                    "simple": "category"
                },
                "Elasticsearch Case Status": {
                    "simple": "status"
                },
                "severity": {
                    "simple": "severity"
                },
                "Tags": {
                    "simple": "tags"
                },
                "Elasticsearch Case ID": {
                    "simple": "id"
                },
                "occurred": {
                    "simple": "created_at"
                },
                "Elasticsearch Timestamp": {
                    "simple": "created_at"
                },
                "dbotMirrorLastSync": {
                    "simple": "updated_at"
                }
            }
        }
    },
    "name": "Elasticsearch Case - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.2.0",
    "supportedModules": [
        "agentix",
        "xsiam"
    ]
}