Palo Alto Networks Prisma Cloud Compute - Incoming Mapper

{
    "id": "PaloAltoNetworks_PrismaCloudCompute-mapper",
    "name": "Palo Alto Networks Prisma Cloud Compute - Incoming Mapper",
    "type": "mapping-incoming",
    "description": "Maps incoming Palo Alto Networks Prisma Cloud Compute  event fields.",
    "defaultIncidentType": "",
	"mapping": {
		"Prisma Cloud Compute Audit": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"Prisma Cloud Compute Activity Type": {
					"complex": null,
					"simple": "activityType"
				},
				"Prisma Cloud Compute AppID": {
					"complex": null,
					"simple": "appID"
				},
				"Prisma Cloud Compute Category": {
					"complex": null,
					"simple": "category"
				},
				"Prisma Cloud Compute Command": {
					"complex": null,
					"simple": "command"
				},
				"Prisma Cloud Compute Container": {
					"complex": null,
					"simple": "container"
				},
				"Prisma Cloud Compute FQDN": {
					"complex": null,
					"simple": "fqdn"
				},
				"Prisma Cloud Compute Forensic": {
					"complex": null,
					"simple": "forensicLink"
				},
				"Prisma Cloud Compute Function": {
					"complex": null,
					"simple": "function"
				},
				"Prisma Cloud Compute Host": {
					"complex": null,
					"simple": "host"
				},
				"Prisma Cloud Compute Image": {
					"complex": null,
					"simple": "image"
				},
				"Prisma Cloud Compute Interactive": {
					"complex": null,
					"simple": "interactive"
				},
				"Prisma Cloud Compute Kubernetes Resource": {
					"complex": null,
					"simple": "kubernetesResource"
				},
				"Prisma Cloud Compute Labels": {
					"complex": {
						"accessor": "",
						"filters": [],
						"root": "labels",
						"transformers": []
					},
					"simple": ""
				},
				"Prisma Cloud Compute Line": {
					"complex": null,
					"simple": "line"
				},
				"Prisma Cloud Compute Log File": {
					"complex": null,
					"simple": "logFile"
				},
				"Prisma Cloud Compute Message": {
					"complex": null,
					"simple": "message"
				},
                "Prisma Cloud Compute Namespaces": {
					"complex": null,
					"simple": "namespaces"
				},
				"Prisma Cloud Compute Raw Alert JSON": {
					"complex": null,
					"simple": "rawJSONAlert"
				},
				"Prisma Cloud Compute Region": {
					"complex": null,
					"simple": "region"
				},
				"Prisma Cloud Compute Rule": {
					"complex": null,
					"simple": "rule"
				},
				"Prisma Cloud Compute Runtime": {
					"complex": null,
					"simple": "runtime"
				},
				"Prisma Cloud Compute Service": {
					"complex": null,
					"simple": "service"
				},
				"Prisma Cloud Compute Type": {
					"complex": null,
					"simple": "type"
				},
				"Prisma Cloud Compute User": {
					"complex": null,
					"simple": "user"
				}
			}
		},
        "Prisma Cloud Compute Audit v2": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"Prisma Cloud Compute Activity Type": {
					"complex": null,
					"simple": "activityType"
				},
				"Prisma Cloud Compute AppID": {
					"complex": null,
					"simple": "appID"
				},
				"Prisma Cloud Compute Category": {
					"complex": null,
					"simple": "category"
				},
				"Prisma Cloud Compute Command": {
					"complex": null,
					"simple": "command"
				},
				"Prisma Cloud Compute Container": {
					"complex": null,
					"simple": "container"
				},
				"Prisma Cloud Compute FQDN": {
					"complex": null,
					"simple": "fqdn"
				},
				"Prisma Cloud Compute Forensic": {
					"complex": null,
					"simple": "forensicLink"
				},
				"Prisma Cloud Compute Function": {
					"complex": null,
					"simple": "function"
				},
				"Prisma Cloud Compute Host": {
					"complex": null,
					"simple": "host"
				},
				"Prisma Cloud Compute Image": {
					"complex": null,
					"simple": "image"
				},
				"Prisma Cloud Compute Interactive": {
					"complex": null,
					"simple": "interactive"
				},
				"Prisma Cloud Compute Kubernetes Resource": {
					"complex": null,
					"simple": "kubernetesResource"
				},
				"Prisma Cloud Compute Labels": {
					"complex": {
						"accessor": "",
						"filters": [],
						"root": "labels",
						"transformers": []
					},
					"simple": ""
				},
				"Prisma Cloud Compute Line": {
					"complex": null,
					"simple": "line"
				},
				"Prisma Cloud Compute Log File": {
					"complex": null,
					"simple": "logFile"
				},
				"Prisma Cloud Compute Message": {
					"complex": null,
					"simple": "message"
				},
                "Prisma Cloud Compute Namespaces": {
					"complex": null,
					"simple": "namespaces"
				},
				"Prisma Cloud Compute Raw Alert JSON": {
					"complex": null,
					"simple": "rawJSONAlert"
				},
				"Prisma Cloud Compute Region": {
					"complex": null,
					"simple": "region"
				},
				"Prisma Cloud Compute Rule": {
					"complex": null,
					"simple": "rule"
				},
				"Prisma Cloud Compute Runtime": {
					"complex": null,
					"simple": "runtime"
				},
				"Prisma Cloud Compute Service": {
					"complex": null,
					"simple": "service"
				},
				"Prisma Cloud Compute Type": {
					"complex": null,
					"simple": "type"
				},
				"Prisma Cloud Compute User": {
					"complex": null,
					"simple": "user"
				}
			}
		},
        "Prisma Cloud Compute Audit v3": {
			"dontMapEventToLabels": true,
			"internalMapping": {
                "Cloud Account ID": {
					"simple": "accountID"
				},
				"External Link": {
					"simple": "consoleLink"
				},
				"Prisma Cloud Compute Activity Type": {
					"complex": null,
					"simple": "activityType"
				},
				"Prisma Cloud Compute AppID": {
					"complex": null,
					"simple": "appID"
				},
				"Prisma Cloud Compute Category": {
					"complex": null,
					"simple": "category"
				},
				"Prisma Cloud Compute Cluster": {
					"simple": "cluster"
				},
				"Prisma Cloud Compute Command": {
					"complex": null,
					"simple": "command"
				},
				"Prisma Cloud Compute Container": {
					"complex": null,
					"simple": "container"
				},
				"Prisma Cloud Compute FQDN": {
					"complex": null,
					"simple": "fqdn"
				},
				"Prisma Cloud Compute Forensic": {
					"complex": null,
					"simple": "forensicLink"
				},
				"Prisma Cloud Compute Function": {
					"complex": null,
					"simple": "function"
				},
				"Prisma Cloud Compute Host": {
					"complex": null,
					"simple": "host"
				},
				"Prisma Cloud Compute Image": {
					"complex": null,
					"simple": "image"
				},
				"Prisma Cloud Compute Interactive": {
					"complex": null,
					"simple": "interactive"
				},
				"Prisma Cloud Compute Kubernetes Resource": {
					"complex": null,
					"simple": "kubernetesResource"
				},
				"Prisma Cloud Compute Labels": {
					"complex": {
						"accessor": "",
						"filters": [],
						"root": "labels",
						"transformers": []
					},
					"simple": ""
				},
				"Prisma Cloud Compute Line": {
					"complex": null,
					"simple": "line"
				},
				"Prisma Cloud Compute Log File": {
					"complex": null,
					"simple": "logFile"
				},
				"Prisma Cloud Compute Message": {
					"complex": null,
					"simple": "message"
				},
                "Prisma Cloud Compute Namespaces": {
					"complex": null,
					"simple": "namespaces"
				},
				"Prisma Cloud Compute Raw Alert JSON": {
					"complex": null,
					"simple": "rawJSONAlert"
				},
				"Prisma Cloud Compute Region": {
					"complex": null,
					"simple": "region"
				},
				"Prisma Cloud Compute Rule": {
					"complex": null,
					"simple": "rule"
				},
				"Prisma Cloud Compute Runtime": {
					"complex": null,
					"simple": "runtime"
				},
				"Prisma Cloud Compute Service": {
					"complex": null,
					"simple": "service"
				},
				"Prisma Cloud Compute Type": {
					"complex": null,
					"simple": "type"
				},
				"Prisma Cloud Compute User": {
					"complex": null,
					"simple": "user"
				}
			}
		},
		"Prisma Cloud Compute Cloud Discovery": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"Prisma Cloud Compute Collections": {
					"complex": {
						"accessor": "",
						"filters": [],
						"root": "collections",
						"transformers": [
							{
								"args": {
									"separator": {
										"isContext": false,
										"value": {
											"complex": null,
											"simple": ", "
										}
									}
								},
								"operator": "join"
							}
						]
					},
					"simple": ""
				},
				"Prisma Cloud Compute Credential ID": {
					"complex": null,
					"simple": "credentialId"
				},
				"Prisma Cloud Compute Error": {
					"complex": null,
					"simple": "err"
				},
				"Prisma Cloud Compute Markdown": {
					"complex": null,
					"simple": "entitiesMarkdownTable"
				},
				"Prisma Cloud Compute Project": {
					"complex": null,
					"simple": "project"
				},
				"Prisma Cloud Compute Protected": {
					"complex": null,
					"simple": "protected"
				},
				"Prisma Cloud Compute Provider": {
					"complex": null,
					"simple": "provider"
				},
				"Prisma Cloud Compute Raw Alert JSON": {
					"complex": null,
					"simple": "rawJSONAlert"
				},
				"Prisma Cloud Compute Region": {
					"complex": null,
					"simple": "region"
				},
				"Prisma Cloud Compute Registry": {
					"complex": null,
					"simple": "registry"
				},
				"Prisma Cloud Compute Service Type": {
					"complex": null,
					"simple": "serviceType"
				},
				"Prisma Cloud Compute Total": {
					"complex": null,
					"simple": "total"
				}
			}
		},
		"Prisma Cloud Compute Compliance": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"Prisma Cloud Compute Markdown": {
					"complex": null,
					"simple": "complianceMarkdownTable"
				},
				"Prisma Cloud Compute Raw Alert JSON": {
					"complex": null,
					"simple": "rawJSONAlert"
				}
			}
		},
        "Prisma Cloud Compute Compliance v2": {
			"dontMapEventToLabels": true,
			"internalMapping": {
                "Alert Category": {
					"complex": null,
					"simple": "type"
				},
                "Compliance Notes": {
					"complex": null,
					"simple": "compliance"
				},
				"Prisma Cloud Compute Markdown": {
					"complex": null,
					"simple": "complianceMarkdownTable"
				},
				"Prisma Cloud Compute Raw Alert JSON": {
					"complex": null,
					"simple": "rawJSONAlert"
				}
			}
		},
		"Prisma Cloud Compute Vulnerability": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"Prisma Cloud Compute Distribution": {
					"complex": null,
					"simple": "distroName"
				},
				"Prisma Cloud Compute Image": {
					"complex": null,
					"simple": "imageName"
				},
				"Prisma Cloud Compute Labels": {
					"complex": {
						"accessor": "",
						"filters": [],
						"root": "labels",
						"transformers": []
					},
					"simple": ""
				},
				"Prisma Cloud Compute Markdown": {
					"complex": null,
					"simple": "vulnerabilitiesMarkdownTable"
				},
				"Prisma Cloud Compute Raw Alert JSON": {
					"complex": null,
					"simple": "rawJSONAlert"
				}
			}
		}
	},
	"version": -1,
	"fromVersion": "6.0.0"
}