{
"id": "Lacework - Incoming Mapper",
"name": "Lacework - Incoming Mapper",
"type": "mapping-incoming",
"description": "Lacework Mapper for incidents",
"version": -1,
"defaultIncidentType": "Lacework Alert",
"fromVersion": "6.0.0",
"mapping": {
"Lacework Alert": {
"dontMapEventToLabels": false,
"internalMapping": {
"Alert ID": {
"complex": {
"accessor": "",
"filters": [],
"root": "alertId",
"transformers": []
},
"simple": ""
},
"Alert Category": {
"complex": {
"accessor": "",
"filters": [],
"root": "derivedFields.category",
"transformers": []
},
"simple": ""
},
"Sub Category": {
"complex": {
"accessor": "",
"filters": [],
"root": "derivedFields.sub_category",
"transformers": []
},
"simple": ""
},
"Alert Source": {
"complex": {
"accessor": "",
"filters": [],
"root": "derivedFields.source",
"transformers": []
},
"simple": ""
},
"Alert Type ID": {
"complex": {
"accessor": "",
"filters": [],
"root": "alertType",
"transformers": []
},
"simple": ""
},
"Lacework Event Actor": {
"complex": {
"accessor": "",
"filters": [],
"root": "EVENT_ACTOR",
"transformers": []
},
"simple": ""
},
"Lacework Event ID": {
"complex": {
"accessor": "",
"filters": [],
"root": "EVENT_ID",
"transformers": []
},
"simple": ""
},
"Lacework Event Model": {
"complex": {
"accessor": "",
"filters": [],
"root": "EVENT_MODEL",
"transformers": []
},
"simple": ""
},
"Lacework Event Type": {
"complex": {
"accessor": "",
"filters": [],
"root": "EVENT_TYPE",
"transformers": []
},
"simple": ""
},
"Lacework Recommendation Account Alias": {
"complex": {
"accessor": "PROPS.account_alias",
"filters": [],
"root": "entityMap.RecId",
"transformers": []
},
"simple": ""
},
"Lacework Recommendation Account ID": {
"complex": {
"accessor": "PROPS.account_id",
"filters": [],
"root": "entityMap.RecId",
"transformers": []
},
"simple": ""
},
"Lacework Recommendation ID": {
"complex": {
"accessor": "KEY.rec_id",
"filters": [],
"root": "entityMap.RecId",
"transformers": []
},
"simple": ""
},
"Lacework Recommendation Title": {
"complex": {
"accessor": "PROPS.title",
"filters": [],
"root": "entityMap.RecId",
"transformers": []
},
"simple": ""
},
"severity": {
"complex": {
"accessor": "",
"filters": [],
"root": "severity",
"transformers": [
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "Critical"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "1"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "High"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "2"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "Medium"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "3"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "Low"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "4"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "Info"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "5"
}
}
},
"operator": "replace"
}
]
},
"simple": ""
}
}
},
"Lacework Event": {
"dontMapEventToLabels": false,
"internalMapping": {
"Lacework Event Actor": {
"complex": {
"accessor": "",
"filters": [],
"root": "EVENT_ACTOR",
"transformers": []
},
"simple": ""
},
"Lacework Event ID": {
"complex": {
"accessor": "",
"filters": [],
"root": "EVENT_ID",
"transformers": []
},
"simple": ""
},
"Lacework Event Model": {
"complex": {
"accessor": "",
"filters": [],
"root": "EVENT_MODEL",
"transformers": []
},
"simple": ""
},
"Lacework Event Type": {
"complex": {
"accessor": "",
"filters": [],
"root": "EVENT_TYPE",
"transformers": []
},
"simple": ""
},
"Lacework Recommendation Account Alias": {
"complex": {
"accessor": "ACCOUNT_ALIAS",
"filters": [],
"root": "ENTITY_MAP.RecId",
"transformers": []
},
"simple": ""
},
"Lacework Recommendation Account ID": {
"complex": {
"accessor": "ACCOUNT_ID",
"filters": [],
"root": "ENTITY_MAP.RecId",
"transformers": []
},
"simple": ""
},
"Lacework Recommendation ID": {
"complex": {
"accessor": "REC_ID",
"filters": [],
"root": "ENTITY_MAP.RecId",
"transformers": []
},
"simple": ""
},
"Lacework Recommendation Title": {
"complex": {
"accessor": "TITLE",
"filters": [],
"root": "ENTITY_MAP.RecId",
"transformers": []
},
"simple": ""
},
"severity": {
"complex": {
"accessor": "",
"filters": [],
"root": "SEVERITY",
"transformers": [
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "Critical"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "1"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "High"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "2"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "Medium"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "3"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "Low"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "4"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {
"isContext": false,
"value": null
},
"replaceWith": {
"isContext": false,
"value": {
"complex": null,
"simple": "Informational"
}
},
"toReplace": {
"isContext": false,
"value": {
"complex": null,
"simple": "5"
}
}
},
"operator": "replace"
}
]
},
"simple": ""
}
}
}
}
}