{
    "description": "Maps incoming Cortex XDR incidents fields.",
    "feed": false,
    "id": "Cortex XDR - IR-mapper",
    "name": "XDR - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.0.0",
    "mapping": {
        "Cortex XDR - Lite": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Additional Data": {
                    "complex": {
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Agent Version": {
                    "complex": {
                        "accessor": "agentversion",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Agents ID": {
                    "complex": {
                        "accessor": "endpoint_id",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "CMD line": {
                    "complex": {
                        "accessor": "action_process_image_command_line",
                        "filters": [],
                        "root": "alerts",
                        "transformers": []
                    }
                },
                "Cloud Provider": {
                    "complex": {
                        "accessor": "cloudprovider",
                        "filters": [],
                        "root": "alerts",
                        "transformers": []
                    }
                },
                "Detected User": {
                    "complex": {
                        "accessor": "user_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Device Id": {
                    "complex": {
                        "accessor": "endpoint_id",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Device Internal IPs": {
                    "complex": {
                        "accessor": "host_ip",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Device Local IP": {
                    "complex": {
                        "accessor": "host_ip",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Device MAC Address": {
                    "complex": {
                        "accessor": "mac",
                        "filters": [],
                        "root": "alerts",
                        "transformers": []
                    }
                },
                "Device Name": {
                    "complex": {
                        "accessor": "hostname",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Device OS Name": {
                    "complex": {
                        "accessor": "agent_os_type",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Device OS Version": {
                    "complex": {
                        "accessor": "agent_os_sub_type",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "External Category Name": {
                    "simple": "alerts.category"
                },
                "External End Time": {
                    "simple": "modification_time"
                },
                "External Link": {
                    "simple": "xdr_url"
                },
                "External Start Time": {
                    "simple": "creation_time"
                },
                "External Status": {
                    "simple": "status"
                },
                "External System ID": {
                    "simple": "incident_id"
                },
                "File Names": {
                    "simple": "alerts.action_file_name"
                },
                "File Paths": {
                    "simple": "alerts.action_file_path"
                },
                "File SHA256": {
                    "simple": "file_artifacts.filesha256"
                },
                "Hostnames": {
                    "complex": {
                        "accessor": "host_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "IncomingMirrorError": {
                    "simple": "in_mirror_error"
                },
                "LastMirroredInTime": {
                    "complex": {
                        "filters": [],
                        "root": "last_mirrored_in",
                        "transformers": [
                            {
                                "operator": "TimeStampToDate"
                            }
                        ]
                    }
                },
                "MITRE Tactic ID": {
                    "simple": "mitre_tactics_ids_and_names"
                },
                "MITRE Tactic Name": {
                    "simple": "mitre_tactics_ids_and_names"
                },
                "MITRE Technique ID": {
                    "simple": "mitre_techniques_ids_and_names"
                },
                "MITRE Technique Name": {
                    "simple": "mitre_techniques_ids_and_names"
                },
                "OutgoingMirrorError": {
                    "simple": "out_mirror_error"
                },
                "Parent CMD line": {
                    "simple": "alerts.causality_actor_process_command_line"
                },
                "Parent Process CMD": {
                    "simple": "alerts.causality_actor_process_command_line"
                },
                "Parent Process MD5": {
                    "simple": "alerts.causality_actor_process_image_md5"
                },
                "Parent Process Name": {
                    "simple": "alerts.causalityactorprocessimagename"
                },
                "Parent Process SHA256": {
                    "simple": "alerts.causality_actor_process_image_sha256"
                },
                "Process CMD": {
                    "simple": "alerts.actor_process_command_line"
                },
                "Process MD5": {
                    "simple": "alerts.actor_process_image_md5"
                },
                "Process Names": {
                    "complex": {
                        "accessor": "actor_process_image_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Process Paths": {
                    "complex": {
                        "accessor": "actor_process_image_path",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Process SHA256": {
                    "simple": "alerts.actor_process_image_sha256"
                },
                "Users": {
                    "simple": "users"
                },
                "XDR Alert Category": {
                    "complex": {
                        "accessor": "category",
                        "filters": [],
                        "root": "alerts",
                        "transformers": []
                    }
                },
                "XDR Alert Count": {
                    "simple": "alert_count"
                },
                "XDR Alert Name": {
                    "simple": "alerts.name"
                },
                "XDR Alerts": {
                    "simple": "alerts"
                },
                "XDR Assigned User Email": {
                    "simple": "assigned_user_mail"
                },
                "XDR Assigned User Pretty Name": {
                    "simple": "assigned_user_pretty_name"
                },
                "XDR Description": {
                    "simple": "description"
                },
                "XDR Detection Time": {
                    "complex": {
                        "filters": [],
                        "root": "detection_time",
                        "transformers": [
                            {
                                "operator": "TimeStampToDate"
                            }
                        ]
                    }
                },
                "XDR File Artifacts": {
                    "simple": "file_artifacts"
                },
                "XDR File Name": {
                    "complex": {
                        "accessor": "file_name",
                        "filters": [],
                        "root": "file_artifacts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "XDR File SHA256": {
                    "complex": {
                        "accessor": "file_sha256",
                        "filters": [],
                        "root": "file_artifacts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "XDR High Severity Alert Count": {
                    "simple": "high_severity_alert_count"
                },
                "XDR Host Count": {
                    "simple": "host_count"
                },
                "XDR Incident ID": {
                    "simple": "incident_id"
                },
                "XDR Low Severity Alert Count": {
                    "simple": "low_severity_alert_count"
                },
                "XDR MITRE Tactics": {
                    "simple": "alerts.mitre_tactic_id_and_name"
                },
                "XDR MITRE Techniques": {
                    "simple": "alerts.mitre_technique_id_and_name"
                },
                "XDR Medium Severity Alert Count": {
                    "simple": "med_severity_alert_count"
                },
                "XDR Modification Time": {
                    "complex": {
                        "filters": [],
                        "root": "modification_time",
                        "transformers": [
                            {
                                "operator": "TimeStampToDate"
                            }
                        ]
                    }
                },
                "XDR Network Artifacts": {
                    "simple": "network_artifacts"
                },
                "XDR Notes": {
                    "simple": "notes"
                },
                "XDR Resolve Comment": {
                    "simple": "resolve_comment"
                },
                "XDR Starred": {
                    "simple": "starred"
                },
                "XDR Status": {
                    "simple": "status"
                },
                "XDR Status v2": {
                    "simple": "status"
                },
                "XDR URL": {
                    "simple": "xdr_url"
                },
                "XDR User Count": {
                    "simple": "user_count"
                },
                "XDR Users": {
                    "complex": {
                        "accessor": "user_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "dbotMirrorDirection": {
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "simple": "incident_id"
                },
                "dbotMirrorInstance": {
                    "simple": "mirror_instance"
                },
                "occurred": {
                    "complex": {
                        "filters": [],
                        "root": "creation_time",
                        "transformers": [
                            {
                                "operator": "TimeStampToDate"
                            }
                        ]
                    }
                },
                "owner": {
                    "simple": "owner"
                },
                "severity": {
					"complex": {
						"filters": [],
						"root": "severity",
						"transformers": [
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "1"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "low"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "2"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "medium"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "3"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "high"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "4"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "critical"
										}
									}
								},
								"operator": "replace"
							}
						]
					}
				}
            }
        },
        "Cortex XDR Incident": {
            "dontMapEventToLabels": true,
            "internalMapping": {
                "Alert tags": {
                    "complex": {
                        "accessor": "tags",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Hostnames": {
                    "complex": {
                        "accessor": "host_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "IncomingMirrorError": {
                    "complex": null,
                    "simple": "in_mirror_error"
                },
                "LastMirroredInTime": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "last_mirrored_in",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "TimeStampToDate"
                            }
                        ]
                    },
                    "simple": ""
                },
                "OutgoingMirrorError": {
                    "complex": null,
                    "simple": "out_mirror_error"
                },
                "XDR Alert Category": {
                    "complex": {
                        "accessor": "category",
                        "filters": [],
                        "root": "alerts",
                        "transformers": []
                    },
                    "simple": ""
                },
                "XDR Alert Count": {
                    "complex": null,
                    "simple": "alert_count"
                },
                "XDR Alert Name": {
                    "complex": null,
                    "simple": "alerts.name"
                },
                "XDR Alerts": {
                    "complex": null,
                    "simple": "alerts"
                },
                "XDR Assigned User Email": {
                    "complex": null,
                    "simple": "assigned_user_mail"
                },
                "XDR Assigned User Pretty Name": {
                    "complex": null,
                    "simple": "assigned_user_pretty_name"
                },
                "XDR Description": {
                    "complex": null,
                    "simple": "description"
                },
                "XDR Detection Time": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "detection_time",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "TimeStampToDate"
                            }
                        ]
                    },
                    "simple": ""
                },
                "XDR File Artifacts": {
                    "complex": null,
                    "simple": "file_artifacts"
                },
                "XDR File Name": {
                    "complex": {
                        "accessor": "file_name",
                        "filters": [],
                        "root": "file_artifacts",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "XDR File SHA256": {
                    "complex": {
                        "accessor": "file_sha256",
                        "filters": [],
                        "root": "file_artifacts",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "XDR High Severity Alert Count": {
                    "complex": null,
                    "simple": "high_severity_alert_count"
                },
                "XDR Host Count": {
                    "complex": null,
                    "simple": "host_count"
                },
                "XDR Incident ID": {
                    "complex": null,
                    "simple": "incident_id"
                },
                "XDR Low Severity Alert Count": {
                    "complex": null,
                    "simple": "low_severity_alert_count"
                },
                "XDR MITRE Tactics": {
                    "complex": null,
                    "simple": "alerts.mitre_tactic_id_and_name"
                },
                "XDR MITRE Techniques": {
                    "complex": null,
                    "simple": "alerts.mitre_technique_id_and_name"
                },
                "XDR Medium Severity Alert Count": {
                    "complex": null,
                    "simple": "med_severity_alert_count"
                },
                "XDR Modification Time": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "modification_time",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "TimeStampToDate"
                            }
                        ]
                    },
                    "simple": ""
                },
                "XDR Network Artifacts": {
                    "complex": null,
                    "simple": "network_artifacts"
                },
                "XDR Notes": {
                    "complex": null,
                    "simple": "notes"
                },
                "XDR Resolve Comment": {
                    "complex": null,
                    "simple": "resolve_comment"
                },
                "XDR Starred": {
                    "complex": null,
                    "simple": "starred"
                },
                "XDR Status": {
                    "complex": null,
                    "simple": "status"
                },
                "XDR Status v2": {
                    "complex": null,
                    "simple": "status"
                },
                "XDR URL": {
                    "complex": null,
                    "simple": "xdr_url"
                },
                "XDR User Count": {
                    "complex": null,
                    "simple": "user_count"
                },
                "XDR Users": {
                    "complex": {
                        "accessor": "user_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "dbotMirrorDirection": {
                    "complex": null,
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "complex": null,
                    "simple": "incident_id"
                },
                "dbotMirrorInstance": {
                    "complex": null,
                    "simple": "mirror_instance"
                },
                "occurred": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "creation_time",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "TimeStampToDate"
                            }
                        ]
                    },
                    "simple": ""
                },
                "owner": {
                    "complex": null,
                    "simple": "owner"
                },
                "severity": {
					"complex": {
						"filters": [],
						"root": "severity",
						"transformers": [
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "1"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "low"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "2"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "medium"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "3"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "high"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "4"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "critical"
										}
									}
								},
								"operator": "replace"
							}
						]
					}
				}
            }
        },
        "Cortex XDR Port Scan": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "XDR Alert Count": {
                    "complex": null,
                    "simple": "alert_count"
                },
                "XDR Assigned User Email": {
                    "complex": null,
                    "simple": "assigned_user_mail"
                },
                "XDR Assigned User Pretty Name": {
                    "complex": null,
                    "simple": "assigned_user_pretty_name"
                },
                "XDR Description": {
                    "complex": null,
                    "simple": "description"
                },
                "XDR Detection Time": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "detection_time",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "TimeStampToDate"
                            }
                        ]
                    },
                    "simple": ""
                },
                "XDR High Severity Alert Count": {
                    "complex": null,
                    "simple": "high_severity_alert_count"
                },
                "XDR Host Count": {
                    "complex": null,
                    "simple": "host_count"
                },
                "XDR Incident ID": {
                    "complex": null,
                    "simple": "incident_id"
                },
                "XDR Low Severity Alert Count": {
                    "complex": null,
                    "simple": "low_severity_alert_count"
                },
                "XDR Medium Severity Alert Count": {
                    "complex": null,
                    "simple": "med_severity_alert_count"
                },
                "XDR Notes": {
                    "complex": null,
                    "simple": "notes"
                },
                "XDR Resolve Comment": {
                    "complex": null,
                    "simple": "resolve_comment"
                },
                "XDR Starred": {
                    "complex": null,
                    "simple": "starred"
                },
                "XDR Status": {
                    "complex": null,
                    "simple": "status"
                },
                "XDR Status v2": {
                    "complex": null,
                    "simple": "status"
                },
                "XDR URL": {
                    "complex": null,
                    "simple": "xdr_url"
                },
                "XDR User Count": {
                    "complex": null,
                    "simple": "user_count"
                },
                "occurred": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "creation_time",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "TimeStampToDate"
                            }
                        ]
                    },
                    "simple": ""
                },
                "severity": {
					"complex": {
						"filters": [],
						"root": "severity",
						"transformers": [
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "1"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "low"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "2"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "medium"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "3"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "high"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "4"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "critical"
										}
									}
								},
								"operator": "replace"
							}
						]
					}
				}
            }
        },
        "Malware Investigation and Response": {
            "dontMapEventToLabels": true,
            "internalMapping": {
                "Additional Data": {
                    "simple": "alerts"
                },
                "Agent Version": {
                    "complex": {
                        "accessor": "agentversion",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Agents ID": {
                    "simple": "alerts.endpoint_id"
                },
                "CMD line": {
                    "simple": "alerts.action_process_image_command_line"
                },
                "Description": {
                    "simple": "description"
                },
                "Detected User": {
                    "complex": {
                        "accessor": "user_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Device Internal IPs": {
                    "simple": "alerts.host_ip"
                },
                "Device Local IP": {
                    "simple": "alerts.[0].host_ip"
                },
                "Device OS Name": {
                    "complex": {
                        "accessor": "agent_os_type",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Device OS Version": {
                    "complex": {
                        "accessor": "agent_os_sub_type",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "External Category Name": {
                    "simple": "alerts.category"
                },
                "External End Time": {
                    "simple": "modification_time"
                },
                "External Link": {
                    "simple": "xdr_url"
                },
                "External Start Time": {
                    "simple": "creation_time"
                },
                "External Status": {
                    "simple": "status"
                },
                "External System ID": {
                    "simple": "incident_id"
                },
                "File Names": {
                    "simple": "alerts.action_file_name"
                },
                "File Paths": {
                    "simple": "alerts.action_file_path"
                },
                "File SHA256": {
                    "simple": "file_artifacts.filesha256"
                },
                "Hostnames": {
                    "complex": {
                        "accessor": "host_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "IncomingMirrorError": {
                    "simple": "in_mirror_error"
                },
                "LastMirroredInTime": {
                    "complex": {
                        "filters": [],
                        "root": "last_mirrored_in",
                        "transformers": [
                            {
                                "operator": "TimeStampToDate"
                            }
                        ]
                    }
                },
                "MITRE Tactic ID": {
                    "simple": "mitre_tactics_ids_and_names"
                },
                "MITRE Tactic Name": {
                    "simple": "mitre_tactics_ids_and_names"
                },
                "MITRE Technique ID": {
                    "simple": "mitre_techniques_ids_and_names"
                },
                "MITRE Technique Name": {
                    "simple": "mitre_techniques_ids_and_names"
                },
                "OutgoingMirrorError": {
                    "simple": "out_mirror_error"
                },
                "Parent CMD line": {
                    "simple": "alerts.causality_actor_process_command_line"
                },
                "Parent Process CMD": {
                    "simple": "alerts.causality_actor_process_command_line"
                },
                "Parent Process MD5": {
                    "simple": "alerts.causality_actor_process_image_md5"
                },
                "Parent Process Name": {
                    "simple": "alerts.causalityactorprocessimagename"
                },
                "Parent Process SHA256": {
                    "simple": "alerts.causality_actor_process_image_sha256"
                },
                "Process CMD": {
                    "simple": "alerts.actor_process_command_line"
                },
                "Process MD5": {
                    "simple": "alerts.actor_process_image_md5"
                },
                "Process Names": {
                    "complex": {
                        "accessor": "actor_process_image_name",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Process Paths": {
                    "complex": {
                        "accessor": "actor_process_image_path",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Process SHA256": {
                    "simple": "alerts.actor_process_image_sha256"
                },
                "Source IPs": {
                    "complex": {
                        "accessor": "host_ip",
                        "filters": [],
                        "root": "alerts",
                        "transformers": [
                            {
                                "operator": "uniq"
                            }
                        ]
                    }
                },
                "Users": {
                    "simple": "users"
                },
                "dbotMirrorDirection": {
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "simple": "incident_id"
                },
                "dbotMirrorInstance": {
                    "simple": "mirror_instance"
                },
                "occurred": {
                    "complex": {
                        "filters": [],
                        "root": "creation_time",
                        "transformers": [
                            {
                                "operator": "TimeStampToDate"
                            }
                        ]
                    }
                },
                "owner": {
                    "simple": "owner"
                },
                "severity": {
					"complex": {
						"filters": [],
						"root": "severity",
						"transformers": [
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "1"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "low"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "2"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "medium"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "3"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "high"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "4"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "critical"
										}
									}
								},
								"operator": "replace"
							}
						]
					}
				}
            }
        }
    }
}