{
"defaultIncidentType": "",
"definitionId": "",
"description": "SentinelOne Incoming Mapper",
"feed": false,
"id": "SentinelOne Incoming Mapper",
"mapping": {
"SentinelOne Incident": {
"dontMapEventToLabels": false,
"internalMapping": {
"Agent ID": {
"simple": "agentRealtimeInfo.agentId"
},
"Agent Version": {
"simple": "agentDetectionInfo.agentVersion"
},
"Classification": {
"simple": "threatInfo.classification"
},
"Device External IP": {
"simple": "agentDetectionInfo.externalIp"
},
"Device Id": {
"simple": "agentDetectionInfo.agentUuid"
},
"Device Internal IPs": {
"simple": "agentDetectionInfo.agentIpV6"
},
"Device Local IP": {
"simple": "agentDetectionInfo.agentIpV4"
},
"Device MAC Address": {
"simple": "agentRealtimeInfo.networkInterfaces.physical"
},
"Device Name": {
"simple": "agentRealtimeInfo.agentComputerName"
},
"Device OS Name": {
"simple": "agentDetectionInfo.agentOsName"
},
"Device OS Version": {
"simple": "agentDetectionInfo.agentOsRevision"
},
"Device Username": {
"simple": "agentDetectionInfo.agentLastLoggedInUserName"
},
"Domain Name": {
"simple": "agentRealtimeInfo.agentDomain"
},
"Endpoint": {
"simple": "agentRealtimeInfo.agentComputerName"
},
"External Confidence": {
"simple": "threatInfo.confidenceLevel"
},
"File MD5": {
"simple": "threatInfo.md5"
},
"File Name": {
"simple": "threatInfo.threatName"
},
"File Path": {
"simple": "threatInfo.filePath"
},
"File SHA1": {
"simple": "threatInfo.sha1"
},
"File SHA256": {
"simple": "threatInfo.sha256"
},
"File Size": {
"simple": "threatInfo.fileSize"
},
"Investigation Stage": {
"simple": "threatInfo.incidentStatusDescription"
},
"OS": {
"simple": "agentRealtimeInfo.agentOsName"
},
"OS Type": {
"simple": "agentRealtimeInfo.agentOsType"
},
"OS Version": {
"simple": "agentRealtimeInfo.agentOsRevision"
},
"SentinelOne Account ID": {
"simple": "agentDetectionInfo.accountId"
},
"SentinelOne Account Name": {
"simple": "agentDetectionInfo.accountName"
},
"SentinelOne Agent Network Status": {
"simple": "agentRealtimeInfo.agentNetworkStatus"
},
"SentinelOne Classification Source": {
"simple": "threatInfo.classificationSource"
},
"SentinelOne Cloud Provider": {
"complex": {
"accessor": "cloudProviders",
"filters": [],
"root": "agentDetectionInfo",
"transformers": [
{
"args": {
"dt": {
"isContext": false,
"value": {
"simple": ".=get_provider(val);function get_provider(d){if(\"AWS\" in d){return \"AWS\"} else if(\"GCP\" in d){return \"GCP\"} else if(\"Azure\" in d){return \"Azure\"} else {return \"N/A\"}};"
}
}
},
"operator": "DT"
}
]
}
},
"SentinelOne Cloud Provider Account": {
"complex": {
"accessor": "cloudAccount",
"filters": [],
"root": "agentDetectionInfo.cloudProviders.AWS",
"transformers": [
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.GCP.cloudAccount"
}
}
},
"operator": "append"
},
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.Azure.cloudAccount"
}
}
},
"operator": "append"
},
{
"args": {
"empty_values": {
"isContext": false
},
"remove_keys": {
"isContext": false,
"value": {
"simple": "true"
}
}
},
"operator": "RemoveEmpty"
}
]
}
},
"SentinelOne Cloud Provider Image": {
"complex": {
"accessor": "cloudImage",
"filters": [],
"root": "agentDetectionInfo.cloudProviders.AWS",
"transformers": [
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.GCP.cloudImage"
}
}
},
"operator": "append"
},
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.Azure.cloudImage"
}
}
},
"operator": "append"
},
{
"args": {
"empty_values": {
"isContext": false
},
"remove_keys": {
"isContext": false,
"value": {
"simple": "true"
}
}
},
"operator": "RemoveEmpty"
}
]
}
},
"SentinelOne Cloud Provider Instance ID": {
"complex": {
"accessor": "cloudInstanceId",
"filters": [],
"root": "agentDetectionInfo.cloudProviders.AWS",
"transformers": [
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.GCP.cloudInstanceId"
}
}
},
"operator": "append"
},
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.Azure.cloudInstanceId"
}
}
},
"operator": "append"
},
{
"args": {
"empty_values": {
"isContext": false
},
"remove_keys": {
"isContext": false,
"value": {
"simple": "true"
}
}
},
"operator": "RemoveEmpty"
}
]
}
},
"SentinelOne Cloud Provider Instance Size": {
"complex": {
"accessor": "cloudInstanceSize",
"filters": [],
"root": "agentDetectionInfo.cloudProviders.AWS",
"transformers": [
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.GCP.cloudInstanceSize"
}
}
},
"operator": "append"
},
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.Azure.cloudInstanceSize"
}
}
},
"operator": "append"
},
{
"args": {
"empty_values": {
"isContext": false
},
"remove_keys": {
"isContext": false,
"value": {
"simple": "true"
}
}
},
"operator": "RemoveEmpty"
}
]
}
},
"SentinelOne Cloud Provider Location": {
"complex": {
"accessor": "cloudLocation",
"filters": [],
"root": "agentDetectionInfo.cloudProviders.AWS",
"transformers": [
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.GCP.cloudLocation"
}
}
},
"operator": "append"
},
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.Azure.cloudLocation"
}
}
},
"operator": "append"
},
{
"args": {
"empty_values": {
"isContext": false
},
"remove_keys": {
"isContext": false,
"value": {
"simple": "true"
}
}
},
"operator": "RemoveEmpty"
}
]
}
},
"SentinelOne Cloud Provider Network": {
"complex": {
"accessor": "cloudNetwork",
"filters": [],
"root": "agentDetectionInfo.cloudProviders.AWS",
"transformers": [
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.GCP.cloudNetwork"
}
}
},
"operator": "append"
},
{
"args": {
"empty_values": {
"isContext": false
},
"remove_keys": {
"isContext": false,
"value": {
"simple": "true"
}
}
},
"operator": "RemoveEmpty"
}
]
}
},
"SentinelOne Cloud Provider Resource Group": {
"simple": "agentDetectionInfo.cloudProviders.Azure.azureResourceGroup"
},
"SentinelOne Cloud Provider Role": {
"simple": "agentDetectionInfo.cloudProviders.AWS.awsRole"
},
"SentinelOne Cloud Provider Security Group": {
"simple": "agentDetectionInfo.cloudProviders.AWS.awsSecurityGroups"
},
"SentinelOne Cloud Provider Service Account": {
"simple": "agentDetectionInfo.cloudProviders.GCP.gcpServiceAccount"
},
"SentinelOne Cloud Provider SubnetId": {
"simple": "agentDetectionInfo.cloudProviders.AWS.awsSubnetIds"
},
"SentinelOne Cloud Provider Tags": {
"complex": {
"accessor": "cloudTags",
"filters": [],
"root": "agentDetectionInfo.cloudProviders.AWS",
"transformers": [
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.GCP.cloudTags"
}
}
},
"operator": "append"
},
{
"args": {
"item": {
"isContext": true,
"value": {
"simple": "agentDetectionInfo.cloudProviders.Azure.cloudTags"
}
}
},
"operator": "append"
},
{
"args": {
"empty_values": {
"isContext": false
},
"remove_keys": {
"isContext": false,
"value": {
"simple": "true"
}
}
},
"operator": "RemoveEmpty"
}
]
}
},
"SentinelOne Group ID": {
"simple": "agentDetectionInfo.groupId"
},
"SentinelOne Group Name": {
"simple": "agentDetectionInfo.groupName"
},
"SentinelOne Kubernetes Cluster": {
"simple": "kubernetesInfo.cluster"
},
"SentinelOne Kubernetes Controller Kind": {
"simple": "kubernetesInfo.controllerKind"
},
"SentinelOne Kubernetes Controller Labels": {
"simple": "kubernetesInfo.controllerLabels"
},
"SentinelOne Kubernetes Controller Name": {
"simple": "kubernetesInfo.controllerName"
},
"SentinelOne Kubernetes Namespace": {
"simple": "kubernetesInfo.namespace"
},
"SentinelOne Kubernetes Namespace Labels": {
"simple": "kubernetesInfo.namespaceLabels"
},
"SentinelOne Kubernetes Node": {
"simple": "kubernetesInfo.node"
},
"SentinelOne Kubernetes Node Labels": {
"simple": "kubernetesInfo.nodeLabels"
},
"SentinelOne Kubernetes Pod": {
"simple": "kubernetesInfo.pod"
},
"SentinelOne Kubernetes Pod Labels": {
"simple": "kubernetesInfo.podLabels"
},
"SentinelOne Kubernetes isContainerQuarantine": {
"simple": "kubernetesInfo.isContainerQuarantine"
},
"SentinelOne Network Interface Details": {
"simple": "agentRealtimeInfo.networkInterfaces"
},
"SentinelOne Site ID": {
"simple": "agentDetectionInfo.siteId"
},
"SentinelOne Site Name": {
"simple": "agentDetectionInfo.siteName"
},
"SentinelOne Threat Analyst Verdict": {
"simple": "threatInfo.analystVerdictDescription"
},
"SentinelOne Threat ID": {
"simple": "id"
},
"SentinelOne Threat Status": {
"simple": "threatInfo.incidentStatusDescription"
},
"SentinelOne Threat Story Line": {
"simple": "threatInfo.storyline"
},
"Threat Name": {
"simple": "threatInfo.threatName"
},
"Verdict": {
"simple": "threatInfo.analystVerdictDescription"
},
"SentinelOne UAM Alert ID": {
"simple": "node.id"
},
"SentinelOne UAM Alert Name": {
"simple": "node.name"
},
"SentinelOne UAM Alert Status": {
"simple": "node.status"
},
"SentinelOne UAM Alert Detection Product": {
"simple": "node.detectionSource.product"
},
"SentinelOne UAM Alert Analyst Verdict": {
"simple": "node.analystVerdict"
},
"SentinelOne UAM Alert Analyst Verdict Mapped": {
"simple": "node.analystVerdict"
},
"SentinelOne UAM Alert Attack Surfaces": {
"simple": "node.attackSurfaces"
},
"SentinelOne UAM Alert External Id": {
"simple": "node.externalId"
},
"dbotMirrorDirection": {
"simple": "mirror_direction"
},
"dbotMirrorId": {
"simple": "id"
},
"dbotMirrorInstance": {
"simple": "mirror_instance"
}
}
},
"dbot_classification_incident_type_all": {
"dontMapEventToLabels": false,
"internalMapping": {
"Agent ID": {
"simple": "agentRealtimeInfo.agentId"
},
"Classification": {
"simple": "threatInfo.classification"
},
"Device External IP": {
"simple": "agentDetectionInfo.externalIp"
},
"Device Local IP": {
"simple": "agentDetectionInfo.agentIpV4"
},
"Device Name": {
"simple": "agentRealtimeInfo.agentComputerName"
},
"Device OS Name": {
"simple": "agentDetectionInfo.agentOsName"
},
"Device Username": {
"simple": "agentDetectionInfo.agentLastLoggedInUserName"
},
"Domain Name": {
"simple": "agentRealtimeInfo.agentDomain"
},
"External Confidence": {
"simple": "threatInfo.confidenceLevel"
},
"External Status": {
"simple": "threatInfo.mitigationStatusDescription"
},
"File MD5": {
"simple": "threatInfo.md5"
},
"File Path": {
"simple": "threatInfo.filePath"
},
"File SHA1": {
"simple": "threatInfo.sha1"
},
"File SHA256": {
"simple": "threatInfo.sha256"
},
"File Size": {
"simple": "threatInfo.fileSize"
},
"OS Type": {
"simple": "agentRealtimeInfo.agentOsType"
},
"Threat Name": {
"simple": "threatInfo.threatName"
},
"Verdict": {
"simple": "threatInfo.analystVerdictDescription"
}
}
}
},
"name": "SentinelOne Incoming Mapper",
"type": "mapping-incoming",
"version": -1,
"fromVersion": "6.0.0"
}