{
    "description": "Maps incoming Chronicle incident fields.",
    "feed": false,
    "id": "Chronicle-mapper",
    "mapping": {
        "Chronicle Rule Detection": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Chronicle Detection Created Time": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "createdTime",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection ID": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "id",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection State": {
                    "complex": {
                        "accessor": "alertState",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection Time": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "detectionTime",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection Type": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "type",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection Window End Time": {
                    "complex": {
                        "accessor": "endTime",
                        "filters": [],
                        "root": "timeWindow",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection Window Start Time": {
                    "complex": {
                        "accessor": "startTime",
                        "filters": [],
                        "root": "timeWindow",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Events": {
                    "complex": {
                        "accessor": "references",
                        "filters": [],
                        "root": "collectionElements",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "ConvertKeysToTableFieldFormat"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Chronicle Rule ID": {
                    "complex": {
                        "accessor": "ruleId",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Rule Name": {
                    "complex": {
                        "accessor": "ruleName",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Rule Type": {
                    "complex": {
                        "accessor": "ruleType",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Rule Version": {
                    "complex": {
                        "accessor": "ruleVersion",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Description": {
                    "complex": {
                        "accessor": "description",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    }
                },
                "Detection URL": {
                    "complex": {
                        "accessor": "urlBackToProduct",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    }
                }
            }
        },
        "Chronicle Curated Rule Detection": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Chronicle Detection Created Time": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "createdTime",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection ID": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "id",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection State": {
                    "complex": {
                        "accessor": "alertState",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection Time": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "detectionTime",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection Type": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "type",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection Window End Time": {
                    "complex": {
                        "accessor": "endTime",
                        "filters": [],
                        "root": "timeWindow",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Detection Window Start Time": {
                    "complex": {
                        "accessor": "startTime",
                        "filters": [],
                        "root": "timeWindow",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Curated Events": {
                    "complex": {
                        "accessor": "references",
                        "filters": [],
                        "root": "collectionElements",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "ConvertKeysToTableFieldFormat"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Chronicle Rule ID": {
                    "complex": {
                        "accessor": "ruleId",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Rule Name": {
                    "complex": {
                        "accessor": "ruleName",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Rule Type": {
                    "complex": {
                        "accessor": "ruleType",
                        "filters": [],
                        "root": "detection",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Description": {
                    "complex": {
                        "accessor": "description",
                        "filters": [],
                        "root": "detection",
                        "transformers": [
                            {
                                "operator": "ArrayToCSV"
                            }
                        ]
                    }
                },
                "Detection URL": {
                    "complex": {
                        "accessor": "urlBackToProduct",
                        "filters": [],
                        "root": "detection",
                        "transformers": [
                            {
                                "operator": "ArrayToCSV"
                            }
                        ]
                    }
                },
                "Risk Score": {
                    "complex": {
                        "accessor": "riskScore",
                        "filters": [],
                        "root": "detection",
                        "transformers": [
                            {
                                "operator": "FirstArrayElement"
                            }
                        ]
                    }
                },
                "Tags": {
                    "complex": {
                        "filters": [],
                        "root": "tags",
                        "transformers": [
                            {
                                "operator": "ArrayToCSV"
                            }
                        ]
                    }
                }
            }
        },
        "Chronicle User Alert": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Chronicle Alert Count": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "Alerts",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Alert Name": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "AlertName",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Events": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "UdmEvents",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "ConvertKeysToTableFieldFormat"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Chronicle First Seen": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "FirstSeen",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Last Seen": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "LastSeen",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle Source Product": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "Sources",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Chronicle User": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "User",
                        "transformers": []
                    },
                    "simple": ""
                }
            }
        }
    },
    "name": "Chronicle - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.0.0"
}