{
"name": "OTSecurity API Incoming Mapper v1",
"id": "OTSecurity API Incoming Mapper v1",
"description": "Sample mapper of OT Security incidents",
"feed": false,
"mapping": {
"Blank": {
"dontMapEventToLabels": false,
"internalMapping": {
}
},
"OTSecurity Rogue Device Found": {
"dontMapEventToLabels": false,
"internalMapping": {
"MAC Address": {
"complex": null,
"simple": "incident_details.offense_source"
},
"OTSecurity Substation Location": {
"complex": null,
"simple": "incident_details.location"
},
"OTSecurity Substation Name": {
"complex": null,
"simple": "incident_details.substation_id"
},
"details": {
"complex": null,
"simple": "incident_details.description"
}
}
},
"dbot_classification_incident_type_all": {
"dontMapEventToLabels": false,
"internalMapping": {
"name": {
"complex": {
"accessor": "",
"filters": [
],
"root": "category",
"transformers": [
{
"args": {
"prefix": {
"isContext": false,
"value": {
"complex": null,
"simple": "New "
}
},
"suffix": {
"isContext": false,
"value": {
"complex": null,
"simple": " - API Triggered"
}
}
},
"operator": "concat"
}
]
},
"simple": ""
}
}
}
},
"type": "mapping-incoming",
"version": -1,
"fromVersion": "6.0.0"
}