{
"name": "IronDefense - Incoming Mapper",
"type": "mapping-incoming",
"id": "IronDefense-mapper",
"description": "IronDefense Mapper",
"mapping": {
"IronDefense Alert Notification": {
"internalMapping": {
"IronDefense Aggregation Criteria": {
"simple": "aggregation_criteria",
"complex": null
},
"IronDefense Alert ID": {
"simple": "",
"complex": {
"root": "id",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Analyst Expectation": {
"simple": "",
"complex": {
"root": "analyst_expectation",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "toLowerCase",
"args": {}
},
{
"operator": "substring",
"args": {
"from": {
"value": {
"simple": "4",
"complex": null
},
"isContext": false
},
"to": {
"value": null,
"isContext": false
}
}
}
]
}
},
"IronDefense Analyst Severity": {
"simple": "",
"complex": {
"root": "analyst_severity",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "toLowerCase",
"args": {}
},
{
"operator": "substring",
"args": {
"from": {
"value": {
"simple": "9",
"complex": null
},
"isContext": false
},
"to": {
"value": null,
"isContext": false
}
}
}
]
}
},
"IronDefense Category": {
"simple": "",
"complex": {
"root": "category",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "toLowerCase",
"args": {}
}
]
}
},
"IronDefense Created": {
"simple": "",
"complex": {
"root": "created",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Event Count": {
"simple": "",
"complex": {
"root": "event_count",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense First Event Created": {
"simple": "",
"complex": {
"root": "first_event_created",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Last event Created": {
"simple": "",
"complex": {
"root": "last_event_created",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Raw Data Format": {
"simple": "",
"complex": {
"root": "raw_data_formats",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Severity": {
"simple": "",
"complex": {
"root": "severity",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Status": {
"simple": "",
"complex": {
"root": "status",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "toLowerCase",
"args": {}
},
{
"operator": "substring",
"args": {
"from": {
"value": {
"simple": "7",
"complex": null
},
"isContext": false
},
"to": {
"value": null,
"isContext": false
}
}
},
{
"operator": "replace",
"args": {
"limit": {
"value": null,
"isContext": false
},
"replaceWith": {
"value": {
"simple": " ",
"complex": null
},
"isContext": false
},
"toReplace": {
"value": {
"simple": "_",
"complex": null
},
"isContext": false
}
}
}
]
}
},
"IronDefense SubCategory": {
"simple": "",
"complex": {
"root": "sub_category",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "toLowerCase",
"args": {}
},
{
"operator": "replace",
"args": {
"limit": {
"value": null,
"isContext": false
},
"replaceWith": {
"value": {
"simple": " ",
"complex": null
},
"isContext": false
},
"toReplace": {
"value": {
"simple": "_",
"complex": null
},
"isContext": false
}
}
}
]
}
},
"IronDefense Updated": {
"simple": "",
"complex": {
"root": "updated",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense VUE URL": {
"simple": "",
"complex": {
"root": "vue_url",
"filters": [],
"accessor": "",
"transformers": []
}
}
},
"dontMapEventToLabels": false
},
"IronDefense Event Notification": {
"internalMapping": {
"IronDefense Alert ID": {
"simple": "",
"complex": {
"root": "alert_id",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense App Domains": {
"simple": "",
"complex": {
"root": "id",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Bytes In": {
"simple": "",
"complex": {
"root": "bytes_in",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Bytes Out": {
"simple": "",
"complex": {
"root": "bytes_out",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Category": {
"simple": "",
"complex": {
"root": "category",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "toLowerCase",
"args": {}
}
]
}
},
"IronDefense Confidence": {
"simple": "",
"complex": {
"root": "confidence",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Dome Shared Time": {
"simple": "",
"complex": {
"root": "iron_dome_shared_time",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Dst Entity Attribute": {
"simple": "",
"complex": {
"root": "dst_entity_attribute",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Dst Entity Attribute Type": {
"simple": "",
"complex": {
"root": "dst_entity_attribute_type",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "substring",
"args": {
"from": {
"value": {
"simple": "4",
"complex": null
},
"isContext": false
},
"to": {
"value": null,
"isContext": false
}
}
}
]
}
},
"IronDefense Dst IP": {
"simple": "",
"complex": {
"root": "dst_ip",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Dst Network ID": {
"simple": "",
"complex": {
"root": "dst_network_id",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Dst Port": {
"simple": "",
"complex": {
"root": "dst_port",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense End Time": {
"simple": "",
"complex": {
"root": "end_time",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Event ID": {
"simple": "",
"complex": {
"root": "id",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Is Blacklisted": {
"simple": "",
"complex": {
"root": "is_blacklisted",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Is Whitelisted": {
"simple": "",
"complex": {
"root": "is_whitelisted",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Primary App Protocol": {
"simple": "",
"complex": {
"root": "primary_app_protocol",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Raw Data Format": {
"simple": "",
"complex": {
"root": "raw_data_formats",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Secondary App Protocol": {
"simple": "",
"complex": {
"root": "secondary_app_protocol",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Severity": {
"simple": "",
"complex": {
"root": "severity",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Src Entity Attribute": {
"simple": "",
"complex": {
"root": "src_entity_attribute",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Src Entity Attribute Type": {
"simple": "",
"complex": {
"root": "src_entity_attribute_type",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "substring",
"args": {
"from": {
"value": {
"simple": "4",
"complex": null
},
"isContext": false
},
"to": {
"value": null,
"isContext": false
}
}
}
]
}
},
"IronDefense Src IP": {
"simple": "",
"complex": {
"root": "src_ip",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Src Network ID": {
"simple": "",
"complex": {
"root": "src_network_id",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Start Time": {
"simple": "",
"complex": {
"root": "start_time",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense SubCategory": {
"simple": "",
"complex": {
"root": "sub_category",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Total Bytes": {
"simple": "",
"complex": {
"root": "total_bytes",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense VUE URL": {
"simple": "",
"complex": {
"root": "vue_url",
"filters": [],
"accessor": "",
"transformers": []
}
}
},
"dontMapEventToLabels": false
},
"IronDefense IronDome Notification": {
"internalMapping": {
"IronDefense Alert IDs": {
"simple": "",
"complex": {
"root": "alert_ids",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Comment Details": {
"simple": "",
"complex": {
"root": "comment_details",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Created": {
"simple": "",
"complex": {
"root": "created",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Dome Tags": {
"simple": "",
"complex": {
"root": "dome_tags",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense High Cognitive System Details": {
"simple": "",
"complex": {
"root": "high_cognitive_system_score_details",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense IronDome Category": {
"simple": "",
"complex": {
"root": "category",
"filters": [],
"accessor": "",
"transformers": [
{
"operator": "toLowerCase",
"args": {}
},
{
"operator": "substring",
"args": {
"from": {
"value": {
"simple": "4",
"complex": null
},
"isContext": false
},
"to": {
"value": null,
"isContext": false
}
}
},
{
"operator": "replace",
"args": {
"limit": {
"value": null,
"isContext": false
},
"replaceWith": {
"value": {
"simple": " ",
"complex": null
},
"isContext": false
},
"toReplace": {
"value": {
"simple": "_",
"complex": null
},
"isContext": false
}
}
}
]
}
},
"IronDefense IronDome ID": {
"simple": "",
"complex": {
"root": "id",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Mismatch Details": {
"simple": "",
"complex": {
"root": "mismatch_details",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Severity Details": {
"simple": "",
"complex": {
"root": "severity_details",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Severity Malicious Details": {
"simple": "",
"complex": {
"root": "severity_malicious_details",
"filters": [],
"accessor": "",
"transformers": []
}
},
"IronDefense Severity Suspicious Details": {
"simple": "",
"complex": {
"root": "severity_suspicious_details",
"filters": [],
"accessor": "",
"transformers": []
}
}
},
"dontMapEventToLabels": false
}
},
"version": -1,
"fromVersion": "6.0.0"
}