{
    "description": "Maps incoming Cymulate assessment finding data to Cortex XSOAR incident fields for the Cymulate Assessment Findings incident type.",
    "feed": false,
    "id": "Cymulate Assessment Findings - Incoming Mapper",
	"mapping": {
		"Cymulate Assessment Findings": {
			"dontMapEventToLabels": false,
			"internalMapping": {
				"Asset Name": {
					"simple": "asset"
				},
				"Cymulate Affected Assets": {
					"simple": "affectedAsset"
				},
				"Cymulate Assessment ID": {
					"simple": "assessmentID"
				},
				"Cymulate Assessment Name": {
					"simple": "assessmentName"
				},
				"Cymulate Attack Type": {
					"simple": "attackType"
				},
				"Cymulate CIS Compliance Support": {
					"complex": {
						"filters": [],
						"root": "cisControls",
						"transformers": [
							{
								"args": {
									"headers": {},
									"is_auto_json_transform": {},
									"json_transform_properties": {},
									"title": {},
									"url_keys": {}
								},
								"operator": "JsonToTable"
							}
						]
					}
				},
				"Cymulate Defense Bypassed": {
					"simple": "defenceBypassed"
				},
				"Cymulate Environment": {
					"simple": "env"
				},
				"Cymulate Finding Name": {
					"simple": "findingName"
				},
				"Cymulate Finding Type": {
					"simple": "type"
				},
				"Cymulate Mitigation Type": {
					"simple": "mitigationType"
				},
				"Cymulate Module": {
					"simple": "module.displayName"
				},
				"Cymulate Nist Compliance Support": {
					"complex": {
						"filters": [],
						"root": "nistControls",
						"transformers": [
							{
								"args": {
									"headers": {},
									"is_auto_json_transform": {},
									"json_transform_properties": {},
									"title": {},
									"url_keys": {}
								},
								"operator": "JsonToTable"
							}
						]
					}
				},
				"Cymulate Softwares": {
					"complex": {
						"filters": [],
						"root": "softwares",
						"transformers": [
							{
								"args": {
									"headers": {},
									"is_auto_json_transform": {},
									"json_transform_properties": {},
									"title": {},
									"url_keys": {}
								},
								"operator": "JsonToTable"
							}
						]
					}
				},
				"Cymulate Status": {
					"simple": "status"
				},
				"Cymulate Template Name": {
					"simple": "assessmentName"
				},
				"Cymulate Test Case": {
					"simple": "testCase"
				},
				"Event ID": {
					"simple": "_id"
				},
				"File Name": {
					"simple": "file.name"
				},
				"MITRE Tactic ID": {
					"simple": "tactics.[].mitreID"
				},
				"MITRE Tactic Name": {
					"simple": "tactics.[].name"
				},
				"MITRE Technique ID": {
					"simple": "techniques.[].mitreID"
				},
				"MITRE Technique Name": {
					"simple": "techniques.[].name"
				},
				"OS": {
					"simple": "os.[0]"
				},
				"Resource Name": {
					"simple": "resource"
				},
				"Risk Name": {
					"complex": {
						"filters": [],
						"root": "risk",
						"transformers": [
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "Info"
										}
									},
									"toReplace": {
										"value": {
											"simple": "0"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "Low"
										}
									},
									"toReplace": {
										"value": {
											"simple": "1"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "Medium"
										}
									},
									"toReplace": {
										"value": {
											"simple": "2"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "High"
										}
									},
									"toReplace": {
										"value": {
											"simple": "3"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "Critical"
										}
									},
									"toReplace": {
										"value": {
											"simple": "4"
										}
									}
								},
								"operator": "replace"
							}
						]
					}
				},
				"SHA1": {
					"simple": "sha1"
				},
				"SHA256": {
					"simple": "sha256"
				},
                "MD5": {
					"simple": "md5"
				},
				"Scenario": {
					"simple": "scenarioName"
				},
				"Tags": {
					"simple": "tags"
				},
				"URLs": {
					"simple": "resource"
				},
				"severity": {
					"complex": {
						"filters": [],
						"root": "risk",
						"transformers": [
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "Informational"
										}
									},
									"toReplace": {
										"value": {
											"simple": "0"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "Low"
										}
									},
									"toReplace": {
										"value": {
											"simple": "1"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "Medium"
										}
									},
									"toReplace": {
										"value": {
											"simple": "2"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "High"
										}
									},
									"toReplace": {
										"value": {
											"simple": "3"
										}
									}
								},
								"operator": "replace"
							},
							{
								"args": {
									"limit": {},
									"replaceWith": {
										"value": {
											"simple": "Critical"
										}
									},
									"toReplace": {
										"value": {
											"simple": "4"
										}
									}
								},
								"operator": "replace"
							}
						]
					}
				}
			}
		}
	},
    "name": "Cymulate Assessment Findings - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.0.0"
}