Flashpoint Compromised Credentials - Incoming Mapper

{
    "description": "Incoming Mapper for Flashpoint Compromised Credentials",
    "feed": false,
    "id": "Flashpoint Compromised Credentials - Incoming Mapper",
    "mapping": {
        "Flashpoint Compromised Credentials": {
            "dontMapEventToLabels": true,
            "internalMapping": {
                "Flashpoint Affected Domain": {
                    "complex": null,
                    "simple": "_source.affected_domain"
                },
                "Flashpoint Breach Source": {
                    "complex": null,
                    "simple": "_source.breach.source"
                },
                "Flashpoint Breach Source Type": {
                    "complex": null,
                    "simple": "_source.breach.source_type"
                },
                "Flashpoint Compromised Email": {
                    "complex": {
                        "accessor": "username",
                        "filters": [],
                        "root": "_source",
                        "transformers": [
                            {
                                "args": {
                                    "applyIfEmpty": {
                                        "value": {
                                            "simple": "true"
                                        }
                                    },
                                    "defaultValue": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "_source.email"
                                        }
                                    }
                                },
                                "operator": "SetIfEmpty"
                            }
                        ]
                    }
                },
                "Flashpoint Compromised Password": {
                    "complex": null,
                    "simple": "_source.password"
                },
                "Flashpoint Created Date": {
                    "complex": null,
                    "simple": "_source.breach.created_at.date-time"
                },
                "Flashpoint First Observed Date": {
                    "complex": null,
                    "simple": "_source.breach.first_observed_at.date-time"
                },
                "Flashpoint Header Indexed At Date": {
                    "complex": {
                        "accessor": "indexed_at",
                        "filters": [],
                        "root": "_source.header_",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "TimeStampToDate"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Flashpoint ID": {
                    "complex": null,
                    "simple": "_source.fpid"
                },
                "Flashpoint Is Fresh": {
                    "complex": null,
                    "simple": "_source.is_fresh"
                },
                "Flashpoint Last Observed Date": {
                    "complex": null,
                    "simple": "_source.last_observed_at.date-time"
                },
                "Flashpoint Password Information": {
                    "complex": {
                        "accessor": "password_complexity",
                        "filters": [],
                        "root": "_source",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "ConvertKeysToTableFieldFormat"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Flashpoint Password Probable Hash Algorithms": {
                    "complex": {
                        "accessor": "probable_hash_algorithms",
                        "filters": [],
                        "root": "_source.password_complexity",
                        "transformers": [
                            {
                                "args": {
                                    "separator": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": ","
                                        }
                                    }
                                },
                                "operator": "join"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Flashpoint Source Basetypes": {
                    "complex": {
                        "accessor": "basetypes",
                        "filters": [],
                        "root": "_source",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "Stringify"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Flashpoint Source Domain": {
                    "complex": null,
                    "simple": "_source.domain"
                },
                "Flashpoint Title": {
                    "complex": null,
                    "simple": "_source.breach.title"
                },
                "Flashpoint Victim": {
                    "complex": null,
                    "simple": "_source.breach.victim"
                },
                "occurred": {
                    "complex": null,
                    "simple": "_source.breach.created_at.date-time"
                }
            }
        }
    },
    "name": "Flashpoint Compromised Credentials - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.0.0"
}