Darktrace Incident Classifier

Classifies all incidents fetched by the Darktrace integration as "Darktrace Model Breach" type incidents for purposes of using the Integration Playbooks.

Darktrace Classification

Details

ID	`b62e079d-a83a-4ef7-8e46-ce59037a310b`
Type	classification
Version	-1
From Version	6.0.0
Default Incident Type	Darktrace Model Breach
Feed	No

Source

classifier-Darktrace.json classifier-Darktrace_AI_Analyst.json classifier-Darktrace_Email.json classifier-Darktrace_Model_Breach.json

Download History Raw

{
    "description": "",
    "feed": false,
    "id": "Darktrace AI Analyst",
    "mapping": {
        "Darktrace AI Analyst Event": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Darktrace AI Analyst Associated Devices": {
                    "complex": {
                        "filters": [],
                        "root": "devices",
                        "transformers": [
                            {
                                "operator": "ConvertKeysToTableFieldFormat"
                            }
                        ]
                    }
                },
                "Darktrace AI Analyst Category": {
                    "complex": {
                        "filters": [],
                        "root": "category",
                        "transformers": []
                    }
                },
                "Darktrace AI Analyst Event Id": {
                    "complex": {
                        "filters": [],
                        "root": "eventId",
                        "transformers": []
                    }
                },
                "Darktrace AI Analyst Group Id": {
                    "complex": {
                        "filters": [],
                        "root": "groupId",
                        "transformers": []
                    }
                },
                "Darktrace AI Analyst Mitre Tactics": {
                    "complex": {
                        "filters": [],
                        "root": "mitreTactics",
                        "transformers": []
                    }
                },
                "Darktrace AI Analyst Related Model Breaches": {
					"complex": {
						"accessor": "0",
						"filters": [],
						"root": "modelBreaches",
						"transformers": [
							{
								"operator": "ConvertKeysToTableFieldFormat"
							}
						]
					}
				},
                "Darktrace AI Analyst Score": {
                    "complex": {
                        "filters": [],
                        "root": "score",
                        "transformers": []
                    }
                },
                "Darktrace AI Analyst Summary": {
                    "complex": {
                        "filters": [],
                        "root": "summary",
                        "transformers": []
                    }
                },
                "Darktrace AI Analyst Title": {
                    "complex": {
                        "filters": [],
                        "root": "title",
                        "transformers": []
                    }
                },
                "External Link": {
                    "complex": {
                        "filters": [],
                        "root": "link",
                        "transformers": []
                    }
                },
                "Source Create time": {
                    "complex": {
                        "filters": [],
                        "root": "createdAt",
                        "transformers": []
                    }
                }
            }
        },
        "dbot_classification_incident_type_all": {
            "dontMapEventToLabels": false,
            "internalMapping": {}
        }
    },
    "name": "Darktrace AI Analyst",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.6.0"
}