Trend Micro Vision One XDR - Incoming Mapper

{
    "description": "Maps incoming Trend Micro Vision One alerts.",
    "feed": false,
    "id": "Trend Micro Vision One XDR - Incoming Mapper",
    "mapping": {
        "Trend Micro Vision One XDR Incident": {
            "dontMapEventToLabels": true,
            "internalMapping": {
                "Alert Name": {
                    "complex": null,
                    "simple": "workbenchName"
                },
                "Description": {
                    "complex": {
                        "accessor": "description",
                        "filters": [],
                        "root": "detail",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Detected User": {
                    "complex": {
                        "accessor": "entityValue",
                        "filters": [
                            [
                                {
                                    "ignoreCase": false,
                                    "left": {
                                        "isContext": true,
                                        "value": {
                                            "complex": null,
                                            "simple": "detail.impactScope.entityType"
                                        }
                                    },
                                    "operator": "isEqualString",
                                    "right": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "account"
                                        }
                                    }
                                }
                            ]
                        ],
                        "root": "detail.impactScope",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Hostnames": {
                    "complex": {
                        "accessor": "entityValue.name",
                        "filters": [
                            [
                                {
                                    "ignoreCase": false,
                                    "left": {
                                        "isContext": true,
                                        "value": {
                                            "complex": null,
                                            "simple": "detail.impactScope.entityType"
                                        }
                                    },
                                    "operator": "isEqualString",
                                    "right": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "host"
                                        }
                                    }
                                }
                            ]
                        ],
                        "root": "detail.impactScope",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Technique ID": {
                    "complex": {
                        "accessor": "mitreTechniques",
                        "filters": [],
                        "root": "detail.matchedRules.matchedFilters",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Trend Micro Vision One XDR Account Count": {
                    "complex": null,
                    "simple": "impactScope.accountCount"
                },
                "Trend Micro Vision One XDR Desktop Count": {
                    "complex": null,
                    "simple": "impactScope.desktopCount"
                },
                "Trend Micro Vision One XDR Detail": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "detail",
                        "transformers": [
                            {
                                "args": {
                                    "headers": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "title": {
                                        "isContext": false,
                                        "value": null
                                    }
                                },
                                "operator": "JsonToTable"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Trend Micro Vision One XDR Email Address Count": {
                    "complex": null,
                    "simple": "impactScope.emailAddressCount"
                },
                "Trend Micro Vision One XDR Impact Scope": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "impactScope",
                        "transformers": [
                            {
                                "args": {
                                    "headers": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "is_auto_json_transform": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "json_transform_properties": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "title": {
                                        "isContext": false,
                                        "value": null
                                    }
                                },
                                "operator": "JsonToTable"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Account Count"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "accountCount"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Desktop Count"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "desktopCount"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Email Address Count"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "emailAddressCount"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Server Count"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "serverCount"
                                        }
                                    }
                                },
                                "operator": "replace"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Trend Micro Vision One XDR Impacted Entities": {
                    "complex": {
                        "accessor": "impactScope",
                        "filters": [],
                        "root": "detail",
                        "transformers": [
                            {
                                "args": {
                                    "headers": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "is_auto_json_transform": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "true"
                                        }
                                    },
                                    "json_transform_properties": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "title": {
                                        "isContext": false,
                                        "value": null
                                    }
                                },
                                "operator": "JsonToTable"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Entity ID"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "entityId"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Type"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "entityType"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Value"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "entityValue"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Related Entities"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "relatedEntities"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Related Indicators"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "relatedIndicators"
                                        }
                                    }
                                },
                                "operator": "replace"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Trend Micro Vision One XDR Impacted Entities JSON": {
                    "complex": {
                        "accessor": "impactScope",
                        "filters": [],
                        "root": "detail",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Trend Micro Vision One XDR Indicators": {
                    "complex": {
                        "accessor": "indicators",
                        "filters": [],
                        "root": "detail",
                        "transformers": [
                            {
                                "args": {
                                    "headers": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "id, objectType, objectValue, relatedEntities"
                                        }
                                    },
                                    "is_auto_json_transform": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "true"
                                        }
                                    },
                                    "json_transform_properties": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "title": {
                                        "isContext": false,
                                        "value": null
                                    }
                                },
                                "operator": "JsonToTable"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Indicator ID"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "id"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Type"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "objectType"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Value"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "objectValue"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {
                                        "isContext": false,
                                        "value": null
                                    },
                                    "replaceWith": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "Related Entities"
                                        }
                                    },
                                    "toReplace": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "relatedEntities"
                                        }
                                    }
                                },
                                "operator": "replace"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Trend Micro Vision One XDR Indicators JSON": {
                    "complex": {
                        "accessor": "indicators",
                        "filters": [],
                        "root": "detail",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Trend Micro Vision One XDR Investigation Status": {
                    "complex": null,
                    "simple": "investigationStatus"
                },
                "Trend Micro Vision One XDR Matched Rules JSON": {
                    "complex": {
                        "accessor": "matchedRules",
                        "filters": [],
                        "root": "detail",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Trend Micro Vision One XDR Priority Score": {
                    "complex": null,
                    "simple": "priorityScore"
                },
                "Trend Micro Vision One XDR Server Count": {
                    "complex": null,
                    "simple": "impactScope.serverCount"
                },
                "Trend Micro Vision One XDR Workbench ID": {
                    "complex": null,
                    "simple": "workbenchId"
                },
                "Trend Micro Vision One XDR Workbench Link": {
                    "complex": null,
                    "simple": "workbenchLink"
                },
                "severity": {
                    "complex": null,
                    "simple": "severity"
                }
            }
        }
    },
    "name": "Trend Micro Vision One XDR - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.2.0"
}