Darktrace Incident Classifier

Classifies all incidents fetched by the Darktrace integration as "Darktrace Model Breach" type incidents for purposes of using the Integration Playbooks.

Darktrace Classification

Details

IDb62e079d-a83a-4ef7-8e46-ce59037a310b
Typeclassification
Version-1
From Version6.0.0
Default Incident TypeDarktrace Model Breach
FeedNo

Source

classifier-Darktrace.json classifier-Darktrace_AI_Analyst.json classifier-Darktrace_Email.json classifier-Darktrace_Model_Breach.json
Download History Raw 
{
    "description": "Maps model breach fields to mappings for use in Integration Playbooks",
    "feed": false,
    "id": "Darktrace Model Breach",
    "mapping": {
        "Darktrace Model Breach Alert": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Darktrace Comment Count": {
                    "complex": {
                        "filters": [],
                        "root": "commentCount",
                        "transformers": []
                    }
                },
                "Darktrace Device Hostname": {
                    "complex": {
                        "accessor": "hostname",
                        "filters": [],
                        "root": "device",
                        "transformers": []
                    }
                },
                "Darktrace Device ID": {
                    "complex": {
                        "accessor": "did",
                        "filters": [],
                        "root": "device",
                        "transformers": []
                    }
                },
                "Darktrace Device IP": {
                    "complex": {
                        "accessor": "ip",
                        "filters": [],
                        "root": "device",
                        "transformers": []
                    }
                },
                "Darktrace Device Label": {
                    "complex": {
                        "accessor": "devicelabel",
                        "filters": [],
                        "root": "device",
                        "transformers": []
                    }
                },
                "Darktrace Device MAC": {
                    "complex": {
                        "accessor": "macaddress",
                        "filters": [],
                        "root": "device",
                        "transformers": []
                    }
                },
                "Darktrace Device Vendor": {
                    "complex": {
                        "accessor": "vendor",
                        "filters": [],
                        "root": "device",
                        "transformers": []
                    }
                },
                "Darktrace Model Breach Category": {
                    "complex": {
                        "accessor": "category",
                        "filters": [],
                        "root": "model",
                        "transformers": []
                    }
                },
                "Darktrace Model Breach Description": {
                    "complex": {
                        "accessor": "description",
                        "filters": [],
                        "root": "model",
                        "transformers": []
                    }
                },
                "Darktrace Model Breach ID": {
                    "complex": {
                        "filters": [],
                        "root": "pbid",
                        "transformers": []
                    }
                },
                "Darktrace Model Breach Name": {
                    "complex": {
                        "accessor": "name",
                        "filters": [],
                        "root": "model",
                        "transformers": []
                    }
                },
                "Darktrace Model Breach Policy Id": {
                    "complex": {
                        "accessor": "pid",
                        "filters": [],
                        "root": "model",
                        "transformers": []
                    }
                },
                "Darktrace Model Breach Priority": {
                    "complex": {
                        "accessor": "priority",
                        "filters": [],
                        "root": "model",
                        "transformers": []
                    }
                },
                "Darktrace Model Breach Score": {
                    "complex": {
                        "filters": [],
                        "root": "score",
                        "transformers": []
                    }
                },
                "Darktrace Model Breach Tags": {
                    "complex": {
                        "accessor": "tags",
                        "filters": [],
                        "root": "model",
                        "transformers": []
                    }
                },
                "External Link": {
                    "complex": {
                        "filters": [],
                        "root": "link",
                        "transformers": []
                    }
                },
                "Model Breach Unique Identifier": {
                    "complex": {
                        "accessor": "uuid",
                        "filters": [],
                        "root": "model",
                        "transformers": []
                    }
                },
                "Process Creation Time": {
                    "complex": {
                        "filters": [],
                        "root": "time",
                        "transformers": []
                    }
                }
            }
        }
    },
    "name": "Darktrace Model Breach",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.6.0"
}