{
"description": "Maps incoming PAN-OS Log incidents.",
"feed": false,
"id": "Panorama Mapper",
"mapping": {
"PAN-OS Correlation Log Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Additional Data": {
"simple": "object_id"
},
"Appliance ID": {
"simple": "serial"
},
"Category": {
"simple": "category"
},
"Device Name": {
"simple": "device_name"
},
"Log Source Type": {
"simple": "type"
},
"Severity": {
"simple": "severity"
},
"Source Create time": {
"simple": "match_time"
},
"Source IP": {
"simple": "src"
},
"Source Username": {
"simple": "srcuser"
},
"Subtype": {
"simple": "subtype"
}
}
},
"PAN-OS Data Log Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Additional Data": {
"simple": "misc"
},
"Appliance ID": {
"simple": "serial"
},
"Category": {
"simple": "category"
},
"Destination Geolocation": {
"complex": {
"accessor": "#text",
"filters": [],
"root": "dstloc",
"transformers": []
}
},
"Destination IP": {
"simple": "dst"
},
"Destination Port": {
"simple": "dport"
},
"Device Name": {
"simple": "device_name"
},
"File Name": {
"simple": "misc"
},
"Log Source Type": {
"simple": "type"
},
"Post Nat Destination Port": {
"simple": "natdport"
},
"Post Nat Source Port": {
"simple": "natsport"
},
"Protocol": {
"simple": "proto"
},
"Rule Name": {
"simple": "rule"
},
"Severity": {
"simple": "severity"
},
"Source Create time": {
"simple": "time_generated"
},
"Source Geolocation": {
"complex": {
"accessor": "#text",
"filters": [],
"root": "srcloc",
"transformers": []
}
},
"Source IP": {
"simple": "src"
},
"Source Port": {
"simple": "sport"
},
"Subtype": {
"simple": "subtype"
},
"Tags": {
"simple": "action"
},
"Threat Name": {
"simple": "threat_name"
}
}
},
"PAN-OS Decryption Log Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Appliance ID": {
"simple": "serial"
},
"Application Name": {
"simple": "app"
},
"Destination Geolocation": {
"simple": "dstloc.#text"
},
"Destination IP": {
"simple": "dst"
},
"Destination Port": {
"simple": "dport"
},
"Device Name": {
"simple": "device_name"
},
"Log Source Name": {
"simple": "logset"
},
"Log Source Type": {
"simple": "type"
},
"Policy ID": {
"simple": "policy_name"
},
"Post Nat Destination IP": {
"simple": "natdst"
},
"Post Nat Destination Port": {
"simple": "natdport"
},
"Post Nat Source IP": {
"simple": "natsrc"
},
"Post Nat Source Port": {
"simple": "natsport"
},
"Protocol": {
"simple": "proto"
},
"Rule Name": {
"simple": "rule"
},
"Source Create time": {
"simple": "time_generated"
},
"Source Geolocation": {
"complex": {
"accessor": "#text",
"filters": [],
"root": "srcloc",
"transformers": []
}
},
"Source IP": {
"simple": "src"
},
"Source Port": {
"simple": "sport"
},
"Source Username": {
"simple": "srcuser"
},
"Subtype": {
"simple": "subtype"
},
"Tags": {
"simple": "action"
}
}
},
"PAN-OS System Log Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Appliance ID": {
"simple": "serial"
},
"Description": {
"simple": "opaque"
},
"Device Name": {
"simple": "device_name"
},
"Event ID": {
"simple": "eventid"
},
"Log Source Type": {
"simple": "type"
},
"Severity": {
"simple": "severity"
},
"Source Create time": {
"simple": "time_generated"
},
"Subtype": {
"simple": "subtype"
}
}
},
"PAN-OS Threat Log Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Appliance ID": {
"simple": "serial"
},
"Application Name": {
"simple": "app"
},
"Category": {
"simple": "category"
},
"Destination Geolocation": {
"complex": {
"accessor": "#text",
"filters": [],
"root": "dstloc",
"transformers": []
}
},
"Destination IP": {
"simple": "dst"
},
"Destination MAC Address": {
"simple": "dst_mac"
},
"Destination Port": {
"simple": "dport"
},
"Detection URL": {
"simple": "misc"
},
"Device Name": {
"simple": "device_name"
},
"Log Source Name": {
"simple": "logset"
},
"Log Source Type": {
"simple": "type"
},
"Post Nat Destination Port": {
"simple": "natdport"
},
"Post Nat Source Port": {
"simple": "natsport"
},
"Protocol": {
"simple": "proto"
},
"Rule Name": {
"simple": "rule"
},
"Severity": {
"simple": "severity"
},
"Source Create time": {
"simple": "time_generated"
},
"Source Geolocation": {
"complex": {
"accessor": "#text",
"filters": [],
"root": "srcloc",
"transformers": []
}
},
"Source Hostname": {
"simple": "src_host"
},
"Source IP": {
"simple": "src"
},
"Source MAC Address": {
"simple": "src_mac"
},
"Source Port": {
"simple": "sport"
},
"Source Username": {
"simple": "srcuser"
},
"Subtype": {
"simple": "subtype"
},
"Tags": {
"simple": "action"
},
"Threat Name": {
"simple": "threat_name"
}
}
},
"PAN-OS Traffic Log Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Appliance ID": {
"simple": "serial"
},
"Application Name": {
"simple": "app"
},
"Category": {
"simple": "category"
},
"Destination IP": {
"simple": "dst"
},
"Destination Port": {
"simple": "dport"
},
"Device Name": {
"simple": "device_name"
},
"Log Source Name": {
"simple": "logset"
},
"Log Source Type": {
"simple": "type"
},
"Post Nat Destination IP": {
"simple": "natdst"
},
"Post Nat Destination Port": {
"simple": "natdport"
},
"Post Nat Source IP": {
"simple": "natsrc"
},
"Post Nat Source Port": {
"simple": "natsport"
},
"Rule Name": {
"simple": "rule"
},
"Source Create time": {
"simple": "time_generated"
},
"Source IP": {
"simple": "src"
},
"Source Port": {
"simple": "sport"
},
"Source Username": {
"simple": "srcuser"
},
"Start Time": {
"simple": "start"
},
"Subtype": {
"simple": "subtype"
},
"Tags": {
"simple": "action"
}
}
},
"PAN-OS URL Log Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Additional Data": {
"simple": "category"
},
"Appliance ID": {
"simple": "serial"
},
"Application Name": {
"simple": "app"
},
"Category": {
"simple": "category"
},
"Destination Geolocation": {
"complex": {
"accessor": "#text",
"filters": [],
"root": "dstloc",
"transformers": []
}
},
"Destination IP": {
"simple": "dst"
},
"Destination MAC Address": {
"simple": "dst_mac"
},
"Destination Port": {
"simple": "dport"
},
"Detection URL": {
"simple": "misc"
},
"Device Name": {
"simple": "device_name"
},
"Log Source Name": {
"simple": "logset"
},
"Log Source Type": {
"simple": "type"
},
"Post Nat Destination Port": {
"simple": "natdport"
},
"Post Nat Source Port": {
"simple": "natsport"
},
"Protocol": {
"simple": "proto"
},
"Rule Name": {
"simple": "rule"
},
"Severity": {
"simple": "severity"
},
"Source Create time": {
"simple": "time_generated"
},
"Source Geolocation": {
"complex": {
"accessor": "#text",
"filters": [],
"root": "srcloc",
"transformers": []
}
},
"Source Hostname": {
"simple": "src_host"
},
"Source IP": {
"simple": "src"
},
"Source MAC Address": {
"simple": "src_mac"
},
"Source Port": {
"simple": "sport"
},
"Source Username": {
"simple": "srcuser"
},
"Subtype": {
"simple": "subtype"
},
"Tags": {
"simple": "action"
},
"Threat Name": {
"simple": "threat_name"
}
}
},
"PAN-OS Wildfire Submissions Log Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Appliance ID": {
"simple": "serial"
},
"Application Name": {
"simple": "app"
},
"Destination Geolocation": {
"complex": {
"accessor": "#text",
"filters": [],
"root": "dstloc",
"transformers": []
}
},
"Destination IP": {
"simple": "dst"
},
"Destination Port": {
"simple": "dport"
},
"Device Name": {
"simple": "category"
},
"File Name": {
"simple": "misc"
},
"Log Source Type": {
"simple": "type"
},
"Post Nat Destination Port": {
"simple": "natdport"
},
"Post Nat Source Port": {
"simple": "natsport"
},
"Protocol": {
"simple": "proto"
},
"Risk Score": {
"simple": "category"
},
"Rule Name": {
"simple": "rule"
},
"Severity": {
"simple": "severity"
},
"Source Create time": {
"simple": "time_generated"
},
"Source Geolocation": {
"simple": "srcloc.#text"
},
"Source IP": {
"simple": "src"
},
"Source Port": {
"simple": "sport"
},
"Subtype": {
"simple": "subtype"
},
"Tags": {
"simple": "action"
},
"Threat Name": {
"simple": "threat_name"
}
}
}
},
"name": "Panorama Mapper",
"type": "mapping-incoming",
"version": -1,
"fromVersion": "6.5.0",
"supportedModules": [
"agentix",
"xsiam"
]
}