{
    "description": "Maps FireEye EX alerts.",
    "feed": false,
    "id": "FireEye EX - Incoming Mapper",
    "mapping": {
        "FireEye EX Alert": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Alert Acknowledgement": {
                    "simple": "ack"
                },
                "Alert Action": {
                    "simple": "action"
                },
                "Alert ID": {
                    "simple": "id"
                },
                "Alert Malicious": {
                    "simple": "malicious"
                },
                "Alert Name": {
                    "simple": "name"
                },
                "Alert URL": {
                    "simple": "alertUrl"
                },
                "Appliance ID": {
                    "simple": "applianceId"
                },
                "Application Id": {
                    "simple": "appliance"
                },
                "Detection URL": {
                    "complex": {
                        "accessor": "url",
                        "filters": [],
                        "root": "explanation.malwareDetected.malware",
                        "transformers": [
                            {
                                "args": {
                                    "item": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "src.url"
                                        }
                                    }
                                },
                                "operator": "append"
                            }
                        ]
                    }
                },
                "Email CC": {
                    "simple": "dst.smtpCc"
                },
                "Email From": {
                    "simple": "src.smtpMailFrom"
                },
                "Email Headers": {
                    "simple": "smtpMessage.smtpHeader"
                },
                "Email Message ID": {
                    "simple": "smtpMessage.id"
                },
                "Email Subject": {
                    "simple": "smtpMessage.subject"
                },
                "Email To": {
                    "simple": "dst.smtpTo"
                },
                "FireEye Email Queue ID": {
                    "simple": "smtpMessage.queueId"
                },
                "FireEye Email Source Domain": {
                    "simple": "src.domain"
                },
                "FireEye Infection ID": {
                    "complex": null,
                    "simple": "rootInfection"
                },
                "FireEye Malware Information": {
                    "simple": "explanation.malwareDetected.malware"
                },
                "FireEye Malware Info": {
                    "simple": "explanation.malwareDetected.malware"
                },
                "MD5": {
                    "simple": "explanation.malwareDetected.malware.md5Sum"
                },
                "Malware Name": {
                    "simple": "explanation.malwareDetected.malware.name"
                },
                "SHA256": {
                    "simple": "explanation.malwareDetected.malware.sha256"
                },
                "Sensor Name": {
                    "simple": "sensor"
                },
                "UUID": {
                    "simple": "uuid"
                },
                "Vendor Product": {
                    "simple": "product"
                },
                "occurred": {
                    "simple": "occurred"
                },
                "severity": {
                    "complex": {
                        "filters": [],
                        "root": "severity",
                        "transformers": [
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "1"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "MINR"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "4"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "CRIT"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "3"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "MAJR"
                                        }
                                    }
                                },
                                "operator": "replace"
                            }
                        ]
                    }
                }
            }
        },
        "Phishing Alerts": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Alert Action": {
                    "simple": "action"
                },
                "Email CC": {
                    "simple": "dst.smtpCc"
                },
                "Email From": {
                    "simple": "src.smtpMailFrom"
                },
                "Email Headers": {
                    "simple": "smtpMessage.smtpHeader"
                },
                "Email Message ID": {
                    "simple": "smtpMessage.id"
                },
                "Email Queue ID": {
                    "simple": "smtpMessage.queueId"
                },
                "Email Source Domain": {
                    "simple": "src.domain"
                },
                "Email Subject": {
                    "simple": "smtpMessage.subject"
                },
                "Email To": {
                    "simple": "dst.smtpTo"
                },
                "UUID": {
                    "simple": "uuid"
                },
                "occurred": {
                    "simple": "occurred"
                },
                "severity": {
                    "complex": {
                        "filters": [],
                        "root": "severity",
                        "transformers": [
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "1"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "minr"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "4"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "crit"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "3"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "majr"
                                        }
                                    }
                                },
                                "operator": "replace"
                            }
                        ]
                    }
                }
            }
        }
    },
    "name": "FireEye EX - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.0.0"
}