FireEye NX IPS Alert - Incoming Mapper v2

Maps FireEye NX IPS alerts.

Details

ID	`FireEye NX IPS Alert - Incoming Mapper v2`
Type	mapping-incoming
Version	-1
From Version	6.0.0
Default Incident Type	—
Feed	No

Source

classifier-mapper-incoming-FireEye_IPS_Alerts_v2.json

Download History Raw

{
    "id": "FireEye NX IPS Alert - Incoming Mapper v2",
    "name": "FireEye NX IPS Alert - Incoming Mapper v2",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.0.0",
    "description": "Maps FireEye NX IPS alerts.",
    "mapping": {
        "FireEye NX IPS Event": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Attack Mode": {
                    "complex": null,
                    "simple": "attackMode"
                },
                "CVE": {
                    "complex": null,
                    "simple": "cveId"
                },
                "Destination IP": {
                    "complex": null,
                    "simple": "dstIp"
                },
                "Destination MAC Address": {
                    "complex": null,
                    "simple": "dstMac"
                },
                "Destination Port": {
                    "complex": null,
                    "simple": "dstPort"
                },
                "Event ID": {
                    "complex": null,
                    "simple": "eventId"
                },
                "FireEye Match Count": {
                    "complex": null,
                    "simple": "signatureMatchCnt"
                },
                "FireEye Signature": {
                    "complex": null,
                    "simple": "ruleName"
                },
                "FireEye Signature ID": {
                    "complex": null,
                    "simple": "signatureIden"
                },
                "FireEye Signature Revision": {
                    "complex": null,
                    "simple": "signatureRev"
                },
                "Source IP": {
                    "complex": null,
                    "simple": "srcIp"
                },
                "Source MAC Address": {
                    "complex": null,
                    "simple": "srcMac"
                },
                "Source Port": {
                    "complex": null,
                    "simple": "srcPort"
                },
                "occurred": {
                    "complex": null,
                    "simple": "occurred"
                },
                "severity": {
                    "complex": null,
                    "simple": "severity"
                }
            }
        }
    }
}