Symantec EDR - Incident Classifier

Symantec EDR Classifier

Symantec Endpoint Detection and Response Classification

Details

ID	`Symantec EDR - Incident Classifier`
Type	classification
Version	-1
From Version	6.5.0
Default Incident Type	—
Feed	No

Key Type Map

Key	Incident Type
`Advanced Attack Techniques`	Symantec EDR Incident
`Analyst Reviewed`	Symantec EDR Incident
`Cloud Analytics`	Symantec EDR Incident
`Email`	Symantec EDR Incident
`Indicators of Compromise`	Symantec EDR Incident
`SEP Detection`	Symantec EDR Incident
`Sandboxing`	Symantec EDR Incident

Source

classifier-SymantecEDR_-_Incident_Classifier.json

Download History Raw

{
    "fromVersion": "6.5.0",
    "name": "Symantec EDR - Incident Classifier",
    "type": "classification",
    "id": "Symantec EDR - Incident Classifier",
    "description": "Symantec EDR Classifier",
    "feed": false,
    "keyTypeMap": {
        "Advanced Attack Techniques": "Symantec EDR Incident",
        "Analyst Reviewed": "Symantec EDR Incident",
        "Cloud Analytics": "Symantec EDR Incident",
        "Email": "Symantec EDR Incident",
        "Indicators of Compromise": "Symantec EDR Incident",
        "SEP Detection": "Symantec EDR Incident",
        "Sandboxing": "Symantec EDR Incident"
    },
    "propagationLabels": [
        "all"
    ],
    "transformer": {
        "complex": {
            "accessor": "detection_type",
            "filters": [],
            "root": "incident",
            "transformers": []
        }
    },
    "version": -1
}