{
	"defaultIncidentType": "",
	"description": "Maps outgoing Cortex XDR incidents fields.",
	"feed": false,
	"id": "Cortex XDR - IR-out-mapper",
	"mapping": {
		"Cortex XDR Incident": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"assigned_user_mail": {
					"complex": null,
					"simple": "xdrassigneduseremail"
				},
				"assigned_user_pretty_name": {
					"complex": null,
					"simple": "xdrassigneduserprettyname"
				},
				"manual_severity": {
					"complex": {
						"filters": [],
						"root": "severity",
						"transformers": [
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "low"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "1"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "medium"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "2"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "high"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "3"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "critical"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "4"
										}
									}
								},
								"operator": "replace"
							}
						]
					}
				},
				"resolve_comment": {
					"complex": null,
					"simple": "xdrresolvecomment"
				},
				"status": {
					"complex": null,
					"simple": "xdrstatusv2"
				}
			}
		},
        "Malware Investigation and Response": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"close_reason": {
					"simple": "closeReason"
				},
				"resolve_comment": {
					"simple": "closeNotes"
				},
				"status": {
					"simple": "externalstatus.[0]"
				}
			}
		},
		"dbot_classification_incident_type_all": {
			"dontMapEventToLabels": true,
			"internalMapping": {
				"assigned_user_mail": {
					"simple": "xdrassigneduseremail"
				},
				"close_reason": {
					"simple": "closeReason"
				},
				"manual_severity": {
					"complex": {
						"filters": [],
						"root": "severity",
						"transformers": [
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "low"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "1"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "medium"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "2"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "high"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "3"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {
										"isContext": false
									},
									"replaceWith": {
										"isContext": false,
										"value": {
											"simple": "critical"
										}
									},
									"toReplace": {
										"isContext": false,
										"value": {
											"simple": "4"
										}
									}
								},
								"operator": "replace"
							}
						]
					}
				},
				"resolve_comment": {
					"simple": "closeNotes"
				},
				"status": {
					"simple": "xdrstatusv2"
				}
			}
		}
	},
	"name": "Cortex XDR - Outgoing Mapper",
	"type": "mapping-outgoing",
	"version": -1,
	"fromVersion": "6.0.0"
}