Darktrace Incident Classifier

Classifies all incidents fetched by the Darktrace integration as "Darktrace Model Breach" type incidents for purposes of using the Integration Playbooks.

Darktrace Classification

Details

ID	`b62e079d-a83a-4ef7-8e46-ce59037a310b`
Type	classification
Version	-1
From Version	6.0.0
Default Incident Type	Darktrace Model Breach
Feed	No

Source

classifier-Darktrace.json classifier-Darktrace_AI_Analyst.json classifier-Darktrace_Email.json classifier-Darktrace_Model_Breach.json

Download History Raw

{
	"defaultIncidentType": "",
	"definitionId": "",
	"description": "",
	"feed": false,
	"id": "Darktrace Email Mapper",
	"fromVersion": "6.10.0",
	"mapping": {
		"Darktrace Email": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"Darktrace Email Action Status": {
					"complex": {
						"filters": [],
						"root": "action_status",
						"transformers": []
					}
				},
				"Darktrace Email Actions": {
					"complex": {
						"filters": [],
						"root": "actions",
						"transformers": []
					}
				},
				"Darktrace Email Actions Taken": {
					"complex": {
						"filters": [],
						"root": "actions",
						"transformers": []
					}
				},
				"Darktrace Email Anomaly Score": {
					"simple": "score"
				},
				"Darktrace Email Attachments": {
					"simple": "attachments"
				},
				"Darktrace Email Critical Tags": {
					"simple": "tags_critical"
				},
				"Darktrace Email Direction": {
					"complex": {
						"filters": [],
						"root": "direction",
						"transformers": []
					}
				},
				"Darktrace Email Group Status": {
					"simple": "is_group_email"
				},
				"Darktrace Email Informational Tags": {
					"simple": "tags_informational"
				},
				"Darktrace Email Links": {
					"simple": "links"
				},
				"Darktrace Email Read Status": {
					"complex": {
						"filters": [],
						"root": "read_status",
						"transformers": []
					}
				},
				"Darktrace Email Receipt Status": {
					"complex": {
						"filters": [],
						"root": "receipt_status",
						"transformers": []
					}
				},
				"Darktrace Email Recipient": {
					"complex": {
						"filters": [],
						"root": "recipient",
						"transformers": []
					}
				},
				"Darktrace Email Release Requested": {
					"complex": {
						"filters": [],
						"root": "release_requested",
						"transformers": []
					}
				},
				"Darktrace Email Sender": {
					"simple": "sender"
				},
				"Darktrace Email Subject": {
					"simple": "subject"
				},
				"Darktrace Email Summary": {
					"simple": "summary"
				},
				"Darktrace Email Time": {
					"simple": "time"
				},
				"Darktrace Email UI Link": {
					"simple": "darktrace_url"
				},
				"Darktrace Email UUID": {
					"simple": "uuid"
				},
				"Darktrace Email Warning Tags": {
					"simple": "tags_warning"
				}
			}
		}
	},
	"name": "Darktrace Email Mapper",
	"type": "mapping-incoming",
	"version": -1
}