{
"description": "Sumo Logic Cloud SIEM Mapper",
"feed": false,
"fromVersion": "6.2.0",
"id": "Sumo Logic Insight - Mapper",
"mapping": {
"Sumo Logic Insight": {
"dontMapEventToLabels": false,
"internalMapping": {
"Alert Category": {
"simple": "source"
},
"Alert ID": {
"simple": "readableId"
},
"Assigned User": {
"simple": "assignedTo"
},
"Detected IPs": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_ip"
}
}
}
]
],
"root": "involvedEntities",
"transformers": []
}
},
"Device MAC Address": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.[].entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_mac"
}
}
}
]
],
"root": "involvedEntities.[]",
"transformers": []
}
},
"Domain Name": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_domain"
}
}
}
]
],
"root": "involvedEntities",
"transformers": []
}
},
"External Link": {
"complex": {
"filters": [],
"root": "sumoUrl",
"transformers": []
}
},
"External Severity": {
"simple": "severity"
},
"File MD5": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_hash"
}
}
}
],
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.value"
}
},
"operator": "stringHasLength",
"right": {
"isContext": false,
"value": {
"simple": "32"
}
}
}
]
],
"root": "involvedEntities",
"transformers": []
}
},
"File Names": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_file"
}
}
}
]
],
"root": "involvedEntities",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"File SHA1": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_hash"
}
}
}
],
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.value"
}
},
"operator": "stringHasLength",
"right": {
"isContext": false,
"value": {
"simple": "40"
}
}
}
]
],
"root": "involvedEntities.value",
"transformers": []
}
},
"File SHA256": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_hash"
}
}
}
],
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.value"
}
},
"operator": "stringHasLength",
"right": {
"isContext": false,
"value": {
"simple": "64"
}
}
}
]
],
"root": "involvedEntities.value",
"transformers": []
}
},
"Hostnames": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_hostname"
}
}
}
]
],
"root": "involvedEntities",
"transformers": []
}
},
"Investigation Stage": {
"simple": "status.displayName"
},
"MITRE Tactic ID": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "tags"
}
},
"operator": "containsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "_mitreAttackTactic"
}
}
}
]
],
"root": "tags",
"transformers": [
{
"args": {
"limit": {
"isContext": false
},
"replaceWith": {
"isContext": false
},
"toReplace": {
"isContext": false,
"value": {
"simple": "_mitreAttackTactic:"
}
}
},
"operator": "replace"
}
]
}
},
"MITRE Technique ID": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "tags"
}
},
"operator": "containsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "_mitreAttackTechnique"
}
}
}
]
],
"root": "tags",
"transformers": [
{
"args": {
"limit": {
"isContext": false
},
"replaceWith": {
"isContext": false
},
"toReplace": {
"isContext": false,
"value": {
"simple": "_mitreAttackTechnique:"
}
}
},
"operator": "replace"
}
]
}
},
"Process Names": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.[].entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_process"
}
}
}
]
],
"root": "involvedEntities.[]",
"transformers": []
}
},
"Sumo Logic Cloud SIEM Insight Entity": {
"complex": {
"filters": [],
"root": "entity",
"transformers": [
{
"operator": "ConvertKeysToTableFieldFormat"
}
]
}
},
"Sumo Logic Cloud SIEM Insight Involved Entities": {
"complex": {
"filters": [],
"root": "involvedEntities",
"transformers": [
{
"operator": "ConvertKeysToTableFieldFormat"
}
]
}
},
"Sumo Logic Cloud SIEM Insight Signals": {
"complex": {
"filters": [],
"root": "signals",
"transformers": [
{
"operator": "ConvertKeysToTableFieldFormat"
}
]
}
},
"Tags": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "tags"
}
},
"operator": "notContainsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "_mitre"
}
}
}
]
],
"root": "tags",
"transformers": []
}
},
"URLs": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_url"
}
}
}
]
],
"root": "involvedEntities",
"transformers": []
}
},
"Users": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_username"
}
}
},
{
"left": {
"isContext": true,
"value": {
"simple": "involvedEntities.entityType"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "_email"
}
}
}
]
],
"root": "involvedEntities",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"dbotMirrorDirection": {
"simple": "mirror_direction"
},
"dbotMirrorId": {
"simple": "readableId"
},
"dbotMirrorInstance": {
"simple": "mirror_instance"
},
"details": {
"simple": "description"
}
}
},
"Sumo Logic Signal": {
"dontMapEventToLabels": false,
"internalMapping": {
"Alert Category": {
"simple": "contentType"
},
"Alert ID": {
"complex": {
"filters": [],
"root": "id",
"transformers": []
}
},
"Alert Name": {
"simple": "name"
},
"Alert Type ID": {
"simple": "ruleId"
},
"Description": {
"simple": "summary"
},
"Destination IP": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "allRecords.[].dstDevice_ip.isInternal"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "false"
}
}
}
]
],
"root": "allRecords.[].dstDevice_ip",
"transformers": []
}
},
"Destination Port": {
"simple": "allRecords.[].dstPort"
},
"Detection URL": {
"complex": {
"accessor": "threat_referenceUrl",
"filters": [],
"root": "allRecords.[]",
"transformers": []
}
},
"Device External IPs": {
"complex": {
"accessor": "device_ip",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "allRecords.[].device_ip_isInternal"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "false"
}
}
}
]
],
"root": "allRecords.[]",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"Device Internal IPs": {
"complex": {
"accessor": "device_ip",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "allRecords.[].device_ip_isInternal"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "true"
}
}
}
]
],
"root": "allRecords.[]",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"External Category Name": {
"simple": "stage"
},
"External Link": {
"simple": "sumoUrl"
},
"External Severity": {
"simple": "severity"
},
"File MD5": {
"simple": "allRecords.[].file_hash_md5"
},
"File Names": {
"simple": "allRecords.[].file_basename"
},
"File SHA1": {
"simple": "allRecords.[].file_hash_sha1"
},
"File SHA256": {
"simple": "allRecords.[].file_hash_sha256"
},
"Hostnames": {
"simple": "allRecords.[].srcDevice_hostname_raw"
},
"MITRE Tactic ID": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "tags"
}
},
"operator": "containsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "_mitreAttackTactic"
}
}
}
]
],
"root": "tags",
"transformers": [
{
"args": {
"limit": {
"isContext": false
},
"replaceWith": {
"isContext": false
},
"toReplace": {
"isContext": false,
"value": {
"simple": "_mitreAttackTactic:"
}
}
},
"operator": "replace"
}
]
}
},
"MITRE Technique ID": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "tags"
}
},
"operator": "containsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "_mitreAttackTechnique"
}
}
}
]
],
"root": "tags",
"transformers": [
{
"args": {
"limit": {
"isContext": false
},
"replaceWith": {
"isContext": false
},
"toReplace": {
"isContext": false,
"value": {
"simple": "_mitreAttackTechnique:"
}
}
},
"operator": "replace"
}
]
}
},
"Policy Actions": {
"complex": {
"accessor": "action",
"filters": [],
"root": "allRecords.[]",
"transformers": []
}
},
"Sumo Logic Cloud SIEM Record Fields JSON": {
"complex": {
"filters": [],
"root": "allRecords",
"transformers": [
{
"args": {
"headers": {
"isContext": false,
"value": {
"simple": "fields"
}
},
"is_auto_json_transform": {
"isContext": false,
"value": {
"simple": "true"
}
},
"json_transform_properties": {
"isContext": false
},
"title": {
"isContext": false
}
},
"operator": "JsonToTable"
},
{
"args": {
"limit": {
"isContext": false
},
"replaceWith": {
"isContext": false,
"value": {
"simple": "| \n|"
}
},
"toReplace": {
"isContext": false,
"value": {
"simple": "\u003cbr\u003e"
}
}
},
"operator": "replace"
}
]
}
},
"Source External IPs": {
"complex": {
"accessor": "srcDevice_ip",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "allRecords.[].srcDevice_ip_isInternal"
}
},
"operator": "isEqualString",
"right": {
"isContext": false,
"value": {
"simple": "false"
}
}
}
]
],
"root": "allRecords.[]",
"transformers": []
}
},
"Source Port": {
"simple": "allRecords.[].srcPort"
},
"Sumo Logic Cloud SIEM Signal Entity": {
"simple": "entity"
},
"Sumo Logic Cloud SIEM Signal Records": {
"complex": {
"filters": [],
"root": "allRecords",
"transformers": []
}
},
"Tags": {
"complex": {
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "tags.[]"
}
},
"operator": "notContainsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "_mitre"
}
}
}
]
],
"root": "tags.[]",
"transformers": []
}
},
"Users": {
"complex": {
"accessor": "user_username_raw",
"filters": [],
"root": "allRecords.[]",
"transformers": []
}
},
"dbotMirrorDirection": {
"simple": "mirror_direction"
},
"dbotMirrorId": {
"simple": "readableId"
},
"dbotMirrorInstance": {
"simple": "mirror_instance"
},
"details": {
"simple": "description"
}
}
},
"dbot_classification_incident_type_all": {
"dontMapEventToLabels": false,
"internalMapping": {
"External Severity": {
"simple": "severity"
}
}
}
},
"name": "Sumo Logic Insight - Mapper",
"type": "mapping-incoming",
"version": -1
}