{
"description": "Maps incoming Vectra Detect incidents fields.",
"feed": false,
"id": "Vectra Detect - Incoming Mapper",
"mapping": {
"Vectra Account": {
"dontMapEventToLabels": false,
"internalMapping": {
"Account ID": {
"simple": "id"
},
"Account Name": {
"complex": {
"filters": [],
"root": "display_name",
"transformers": []
}
},
"Department": {
"simple": "ldap.department.[0]"
},
"Display Name": {
"simple": "ldap.display_name.[0]"
},
"Email": {
"simple": "ldap.email.[0]"
},
"External Severity": {
"simple": "severity"
},
"Incident Link": {
"complex": {
"accessor": "UI_URL",
"filters": [],
"root": "_vectra_specific",
"transformers": []
}
},
"State": {
"complex": {
"filters": [],
"root": "state",
"transformers": []
}
},
"Tags": {
"complex": {
"filters": [],
"root": "tags",
"transformers": []
}
},
"Title": {
"simple": "ldap.title.[0]"
},
"Usernames": {
"simple": "name"
},
"Vectra Account Host Access History": {
"complex": {
"filters": [],
"root": "host_access_history",
"transformers": []
}
},
"Vectra Account Type": {
"complex": {
"filters": [],
"root": "account_type",
"transformers": [
{
"args": {
"separator": {
"value": {
"simple": ","
}
}
},
"operator": "join"
}
]
}
},
"Vectra Assigned By": {
"complex": {
"accessor": "username",
"filters": [],
"root": "assignment_details.assigned_by",
"transformers": []
}
},
"Vectra Assigned Date": {
"complex": {
"accessor": "date_assigned",
"filters": [],
"root": "assignment_details",
"transformers": []
}
},
"Vectra Assigned To": {
"complex": {
"accessor": "username",
"filters": [],
"root": "assignment_details.assigned_to",
"transformers": []
}
},
"Vectra Certainty Score": {
"complex": {
"filters": [],
"root": "certainty",
"transformers": []
}
},
"Vectra Detection Count": {
"complex": {
"accessor": "detection_id",
"filters": [],
"root": "detection_summaries",
"transformers": [
{
"operator": "count"
}
]
}
},
"Vectra Detection Details": {
"complex": {
"filters": [],
"root": "detection_details",
"transformers": [
{
"operator": "StringifyArray"
}
]
}
},
"Vectra Groups": {
"complex": {
"filters": [],
"root": "groups",
"transformers": []
}
},
"Vectra Entity Type": {
"complex": {
"accessor": "entity_type",
"filters": [],
"root": "_vectra_specific",
"transformers": []
}
},
"Vectra Assignment ID": {
"complex": {
"accessor": "id",
"filters": [],
"root": "assignment_details",
"transformers": []
}
},
"Vectra Last Detection Timestamp": {
"complex": {
"filters": [],
"root": "last_detection_timestamp",
"transformers": []
}
},
"Vectra Assignment Outcome": {
"complex": {
"accessor": "title",
"filters": [],
"root": "assignment_details.outcome",
"transformers": []
}
},
"Vectra Privilege Category": {
"complex": {
"filters": [],
"root": "privilege_category",
"transformers": []
}
},
"Vectra Privilege Level": {
"complex": {
"filters": [],
"root": "privilege_level",
"transformers": []
}
},
"Vectra Assignment Resolved By": {
"complex": {
"accessor": "username",
"filters": [],
"root": "assignment_details.resolved_by",
"transformers": []
}
},
"Vectra Assignment Resolved Date": {
"complex": {
"accessor": "date_resolved",
"filters": [],
"root": "assignment_details",
"transformers": []
}
},
"Vectra Sensors": {
"complex": {
"filters": [],
"root": "sensors",
"transformers": []
}
},
"Vectra Service Access History": {
"complex": {
"filters": [],
"root": "service_access_history",
"transformers": []
}
},
"Vectra Threat Score": {
"complex": {
"filters": [],
"root": "threat",
"transformers": []
}
},
"sAMAccountName": {
"simple": "ldap.sAMAccountName.[0]"
},
"dbotMirrorDirection": {
"complex": {
"filters": [],
"root": "mirror_direction",
"transformers": []
}
},
"dbotMirrorId": {
"complex": {
"filters": [],
"root": "mirror_id",
"transformers": []
}
},
"dbotMirrorInstance": {
"complex": {
"filters": [],
"root": "mirror_instance",
"transformers": []
}
},
"dbotMirrorTags": {
"complex": {
"filters": [],
"root": "mirror_tags",
"transformers": []
}
},
"severity": {
"complex": {
"filters": [],
"root": "calculated_severity",
"transformers": []
}
}
}
},
"Vectra Detection": {
"dontMapEventToLabels": false,
"internalMapping": {
"Description": {
"simple": "summary.description"
},
"Destination IPs": {
"simple": "summary.dst_ips"
},
"Detection ID": {
"simple": "id"
},
"Dst Ports": {
"simple": "summary.dst_ports"
},
"External Category Name": {
"simple": "category"
},
"External End Time": {
"simple": "last_timestamp"
},
"External Start Time": {
"simple": "first_timestamp"
},
"Source Hostname": {
"simple": "src_host.name"
},
"Source IP": {
"simple": "src_host.ip"
},
"Source Username": {
"simple": "src_linked_account.name"
},
"Threat Name": {
"simple": "detection_type"
}
}
},
"Vectra Host": {
"dontMapEventToLabels": false,
"internalMapping": {
"Department": {
"simple": "ldap.display_name.[0]"
},
"Device Id": {
"simple": "id"
},
"Device Local IP": {
"simple": "ip"
},
"Device Name": {
"simple": "name"
},
"Display Name": {
"simple": "ldap.department.[0]"
},
"Email": {
"simple": "ldap.email.[0]"
},
"External Severity": {
"simple": "severity"
},
"External System ID": {
"simple": "host_luid"
},
"Hostnames": {
"complex": {
"accessor": "value",
"filters": [
[
{
"left": {
"isContext": true,
"value": {
"simple": "host_artifact_set.type"
}
},
"operator": "isNotEqualString",
"right": {
"isContext": false,
"value": {
"simple": "mac"
}
}
}
]
],
"root": "host_artifact_set",
"transformers": []
}
},
"dbotMirrorDirection": {
"complex": {
"filters": [],
"root": "mirror_direction",
"transformers": []
}
},
"dbotMirrorId": {
"complex": {
"filters": [],
"root": "mirror_id",
"transformers": []
}
},
"dbotMirrorInstance": {
"complex": {
"filters": [],
"root": "mirror_instance",
"transformers": []
}
},
"dbotMirrorTags": {
"complex": {
"filters": [],
"root": "mirror_tags",
"transformers": []
}
},
"Incident Link": {
"complex": {
"accessor": "UI_URL",
"filters": [],
"root": "_vectra_specific",
"transformers": []
}
},
"State": {
"complex": {
"filters": [],
"root": "state",
"transformers": []
}
},
"Tags": {
"complex": {
"filters": [],
"root": "tags",
"transformers": []
}
},
"Title": {
"simple": "ldap.title.[0]"
},
"Vectra Assigned By": {
"complex": {
"accessor": "username",
"filters": [],
"root": "assignment_details.assigned_by",
"transformers": []
}
},
"Vectra Assigned Date": {
"complex": {
"accessor": "date_assigned",
"filters": [],
"root": "assignment_details",
"transformers": []
}
},
"Vectra Assigned To": {
"complex": {
"accessor": "username",
"filters": [],
"root": "assignment_details.assigned_to",
"transformers": []
}
},
"Vectra Certainty Score": {
"complex": {
"filters": [],
"root": "certainty",
"transformers": []
}
},
"Vectra Detection Count": {
"complex": {
"accessor": "detection_id",
"filters": [],
"root": "detection_summaries",
"transformers": [
{
"operator": "count"
}
]
}
},
"Vectra Detection Details": {
"complex": {
"filters": [],
"root": "detection_details",
"transformers": [
{
"operator": "StringifyArray"
}
]
}
},
"Vectra Detection Profile": {
"complex": {
"filters": [],
"root": "detection_profile",
"transformers": []
}
},
"Vectra Groups": {
"complex": {
"filters": [],
"root": "groups",
"transformers": []
}
},
"Vectra Entity Type": {
"complex": {
"accessor": "entity_type",
"filters": [],
"root": "_vectra_specific",
"transformers": []
}
},
"Vectra Host Account Access History": {
"complex": {
"filters": [],
"root": "account_access_history",
"transformers": []
}
},
"Vectra Host Active Traffic": {
"complex": {
"filters": [],
"root": "has_active_traffic",
"transformers": []
}
},
"Vectra Host Artifact Set": {
"complex": {
"filters": [],
"root": "host_artifact_set",
"transformers": [
{
"args": {
"headers": {
"isContext": false
},
"is_auto_json_transform": {
"isContext": false
},
"json_transform_properties": {
"isContext": false
},
"title": {
"isContext": false,
"value": {
"simple": "Vectra Host Artifact Set"
}
}
},
"operator": "JsonToTable"
}
]
}
},
"Vectra Host Key Asset": {
"complex": {
"filters": [],
"root": "is_key_asset",
"transformers": []
}
},
"Vectra Host Previous IPs": {
"complex": {
"filters": [],
"root": "previous_ips",
"transformers": []
}
},
"Vectra Host Targets Key Asset": {
"complex": {
"filters": [],
"root": "is_targeting_key_asset",
"transformers": []
}
},
"Vectra Assignment ID": {
"complex": {
"accessor": "id",
"filters": [],
"root": "assignment_details",
"transformers": []
}
},
"Vectra Last Detection Timestamp": {
"complex": {
"filters": [],
"root": "last_detection_timestamp",
"transformers": []
}
},
"Vectra Assignment Outcome": {
"complex": {
"accessor": "title",
"filters": [],
"root": "assignment_details.outcome",
"transformers": []
}
},
"Vectra Privilege Category": {
"complex": {
"filters": [],
"root": "privilege_category",
"transformers": []
}
},
"Vectra Privilege Level": {
"complex": {
"filters": [],
"root": "privilege_level",
"transformers": []
}
},
"Vectra Assignment Resolved By": {
"complex": {
"accessor": "username",
"filters": [],
"root": "assignment_details.resolved_by",
"transformers": []
}
},
"Vectra Assignment Resolved Date": {
"complex": {
"accessor": "date_resolved",
"filters": [],
"root": "assignment_details",
"transformers": []
}
},
"Vectra Sensors": {
"complex": {
"filters": [],
"root": "sensor_name",
"transformers": []
}
},
"Vectra Service Access History": {
"complex": {
"filters": [],
"root": "service_access_history",
"transformers": []
}
},
"Vectra Threat Score": {
"complex": {
"filters": [],
"root": "threat",
"transformers": []
}
},
"sAMAccountName": {
"simple": "ldap.sAMAccountName.[0]"
},
"severity": {
"complex": {
"filters": [],
"root": "calculated_severity",
"transformers": []
}
}
}
},
"dbot_classification_incident_type_all": {
"dontMapEventToLabels": true,
"internalMapping": {
"External Link": {
"simple": "_vectra_specific.UI_URL"
},
"External Status": {
"simple": "state"
},
"Tags": {
"simple": "tags"
},
"Vectra Certainty Score": {
"simple": "certainty"
},
"Vectra Threat Score": {
"simple": "threat"
}
}
}
},
"name": "Vectra Detect - Incoming Mapper",
"type": "mapping-incoming",
"version": -1,
"fromVersion": "6.5.0"
}