Splunk ES - Outgoing Mapper

Maps Splunk Enterprise Security (ES) Finding and Investigation outgoing fields for mirror-out functionality.

Splunk Mapper (Out)

Details

IDSplunk ES - Outgoing Mapper
Typemapping-outgoing
Version-1
From Version6.2.0
Default Incident Type—
FeedNo

Source

classifier-Splunk_ES_Outgoing_Mapper.json
Download History Raw 
{
    "description": "Maps Splunk Enterprise Security (ES) Finding and Investigation outgoing fields for mirror-out functionality.",
    "feed": false,
    "id": "Splunk ES - Outgoing Mapper",
    "mapping": {
        "Splunk Finding": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "status": {
                    "complex": null,
                    "simple": "splunkstatus"
                },
                "urgency": {
                    "complex": null,
                    "simple": "splunkurgency"
                },
                "disposition": {
                    "complex": null,
                    "simple": "splunkdisposition"
                }
            }
        },
        "Splunk Investigation": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "status": {
                    "complex": null,
                    "simple": "splunkstatus"
                },
                "urgency": {
                    "complex": null,
                    "simple": "splunkurgency"
                },
                "disposition": {
                    "complex": null,
                    "simple": "splunkdisposition"
                }
            }
        },
        "dbot_classification_incident_type_all": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "owner": {
                    "complex": null,
                    "simple": "owner"
                }
            }
        }
    },
    "name": "Splunk ES - Outgoing Mapper",
    "type": "mapping-outgoing",
    "version": -1,
    "marketplaces": [
        "xsoar",
        "marketplacev2",
        "platform"
    ],
    "fromVersion": "6.2.0",
    "supportedModules": [
        "xsiam",
        "agentix"
    ]
}