{ "description": "", "feed": false, "id": "Group-IB Threat Intelligence (mapper)", "mapping": { "GIB Compromised Account": { "dontMapEventToLabels": true, "internalMapping": { "GIB Address": { "complex": { "accessor": "address", "filters": [], "root": "person", "transformers": [] } }, "GIB Compromised Login": { "complex": { "filters": [], "root": "login", "transformers": [] } }, "GIB Date Compromised": { "complex": { "filters": [], "root": "dateCompromised", "transformers": [] } }, "GIB Date of Detection": { "complex": { "filters": [], "root": "dateDetected", "transformers": [] } }, "GIB Drop Email": { "complex": { "accessor": "email", "filters": [], "root": "dropEmail", "transformers": [] } }, "GIB Drop Email Domain": { "complex": { "accessor": "domain", "filters": [], "root": "dropEmail", "transformers": [] } }, "GIB Email": { "complex": { "accessor": "email", "filters": [], "root": "person", "transformers": [] } }, "GIB ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "GIB Malware Name": { "complex": { "accessor": "name", "filters": [], "root": "malware", "transformers": [] } }, "GIB Password": { "complex": { "filters": [], "root": "password", "transformers": [] } }, "GIB Person": { "complex": { "accessor": "name", "filters": [], "root": "person", "transformers": [] } }, "GIB Portal Link": { "complex": { "filters": [], "root": "portalLink", "transformers": [] } }, "GIB Related Indicators Data": { "complex": { "filters": [], "root": "relatedIndicatorsData", "transformers": [] } }, "GIB Severity": { "complex": { "accessor": "severity", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Source": { "complex": { "filters": [], "root": "sourceType", "transformers": [] } }, "GIB Threat Actor ID": { "complex": { "accessor": "id", "filters": [], "root": "threatActor", "transformers": [] } }, "GIB Threat Actor Name": { "complex": { "accessor": "name", "filters": [], "root": "threatActor", "transformers": [] } }, "GIB Threat Actor is APT": { "complex": { "accessor": "isAPT", "filters": [], "root": "threatActor", "transformers": [] } }, "GIB Victim IP": { "complex": { "accessor": "ip", "filters": [], "root": "client.ipv4", "transformers": [] } }, "Phone Number": { "complex": { "accessor": "phone", "filters": [], "root": "person", "transformers": [] } }, "severity": { "complex": { "filters": [], "root": "systemSeverity", "transformers": [] } }, "GIB Admiralty Code": { "complex": { "accessor": "admiraltyCode", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Credibility": { "complex": { "accessor": "credibility", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Reliability": { "complex": { "accessor": "reliability", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Compromised Card": { "dontMapEventToLabels": true, "internalMapping": { "GIB Address": { "complex": { "accessor": "address", "filters": [], "root": "owner", "transformers": [] } }, "GIB CVV": { "complex": { "accessor": "cvv", "filters": [], "root": "cardInfo", "transformers": [] } }, "GIB Card Issuer": { "complex": { "accessor": "issuer", "filters": [], "root": "cardInfo.issuer", "transformers": [] } }, "GIB Card Number": { "complex": { "accessor": "number", "filters": [], "root": "cardInfo", "transformers": [] } }, "GIB Card Type": { "complex": { "accessor": "type", "filters": [], "root": "cardInfo", "transformers": [] } }, "GIB Card Valid Thru": { "complex": { "accessor": "validThru", "filters": [], "root": "cardInfo", "transformers": [] } }, "GIB Date Compromised": { "complex": { "filters": [], "root": "dateCompromised", "transformers": [] } }, "GIB Date of Detection": { "complex": { "filters": [], "root": "dateDetected", "transformers": [] } }, "GIB Email": { "complex": { "accessor": "email", "filters": [], "root": "owner", "transformers": [] } }, "GIB ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "GIB Malware Name": { "complex": { "accessor": "name", "filters": [], "root": "malware", "transformers": [] } }, "GIB Payment System": { "complex": { "accessor": "system", "filters": [], "root": "cardInfo", "transformers": [] } }, "GIB Person": { "complex": { "accessor": "name", "filters": [], "root": "owner", "transformers": [] } }, "GIB Portal Link": { "complex": { "filters": [], "root": "portalLink", "transformers": [] } }, "GIB Related Indicators Data": { "complex": { "filters": [], "root": "relatedIndicatorsData", "transformers": [] } }, "GIB Severity": { "complex": { "accessor": "severity", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Source": { "complex": { "filters": [], "root": "sourceType", "transformers": [] } }, "GIB Threat Actor ID": { "complex": { "accessor": "id", "filters": [], "root": "threatActor", "transformers": [] } }, "GIB Threat Actor Name": { "complex": { "accessor": "name", "filters": [], "root": "threatActor", "transformers": [] } }, "GIB Threat Actor is APT": { "complex": { "accessor": "isAPT", "filters": [], "root": "threatActor", "transformers": [] } }, "Phone Number": { "complex": { "accessor": "phone", "filters": [], "root": "owner", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Admiralty Code": { "complex": { "accessor": "admiraltyCode", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Credibility": { "complex": { "accessor": "credibility", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Reliability": { "complex": { "accessor": "reliability", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Data Breach": { "dontMapEventToLabels": true, "internalMapping": { "GIB Email": { "complex": { "filters": [], "root": "email", "transformers": [ { "args": { "separator": { "value": { "simple": ", " } } }, "operator": "join" } ] } }, "GIB ID": { "simple": "id" }, "GIB Leak Name": { "simple": "leakName" }, "GIB Password": { "complex": { "filters": [], "root": "password", "transformers": [ { "args": { "separator": { "value": { "simple": ", " } } }, "operator": "join" } ] } }, "GIB Severity": { "simple": "evaluation.severity" }, "severity": { "simple": "systemSeverity" }, "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "Country": { "complex": { "accessor": "[0]", "filters": [], "root": "countries", "transformers": [] } }, "Description": { "simple": "description" }, "GIB Email Domains": { "simple": "emailDomains" }, "GIB Emails": { "simple": "emails" }, "GIB Leak Published": { "simple": "leakPublished" }, "GIB Passwords": { "simple": "passwords" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Source": { "simple": "sourceType" }, "GIB Update Time": { "simple": "updateTime" }, "GIB Upload Time": { "simple": "uploadTime" }, "Target": { "complex": { "accessor": "[0]", "filters": [], "root": "targetedCompany", "transformers": [] } }, "name": { "complex": { "filters": [], "root": "title", "transformers": [] } }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB OSI Git Leak": { "dontMapEventToLabels": true, "internalMapping": { "GIB Date of Detection": { "complex": { "filters": [], "root": "dateDetected", "transformers": [] } }, "GIB ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "GIB Leaked File Name": { "complex": { "filters": [], "root": "leaked_file_name", "transformers": [] } }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Severity": { "complex": { "accessor": "severity", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Source": { "complex": { "filters": [], "root": "sourceType", "transformers": [] } }, "severity": { "complex": { "filters": [], "root": "systemSeverity", "transformers": [] } }, "GIB Admiralty Code": { "complex": { "accessor": "admiraltyCode", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Credibility": { "complex": { "accessor": "credibility", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Reliability": { "complex": { "accessor": "reliability", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Date Created": { "simple": "dateCreated" }, "GIB GIT Source": { "simple": "source" }, "GIB OSI Git Repository Files Table": { "simple": "files" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB OSI Public Leak": { "dontMapEventToLabels": true, "internalMapping": { "GIB Data Hash": { "complex": { "filters": [], "root": "hash", "transformers": [] } }, "GIB Date Created": { "complex": { "filters": [], "root": "created", "transformers": [] } }, "GIB ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "GIB Leaked Data": { "complex": { "filters": [], "root": "data", "transformers": [] } }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Severity": { "complex": { "accessor": "severity", "filters": [], "root": "evaluation", "transformers": [] } }, "severity": { "complex": { "filters": [], "root": "systemSeverity", "transformers": [] } }, "GIB Admiralty Code": { "complex": { "accessor": "admiraltyCode", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Credibility": { "complex": { "accessor": "credibility", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Reliability": { "complex": { "accessor": "reliability", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Link List Table": { "simple": "linkList" }, "GIB Matches Table": { "simple": "matches" }, "GIB Source": { "simple": "sourceType" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "dbot_classification_incident_type_all": { "dontMapEventToLabels": true, "internalMapping": {} }, "GIB Attacks DDOS": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB CNC": { "simple": "cnc.cnc" }, "GIB CNC Domain": { "simple": "cnc.domain" }, "GIB CNC Port": { "simple": "cnc.port" }, "GIB CNC URL": { "simple": "cnc.url" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB DDOS Date Begin": { "simple": "dateBegin" }, "GIB DDOS Date End": { "simple": "dateEnd" }, "GIB DDOS Date Registration": { "simple": "dateReg" }, "GIB DDOS Duration": { "simple": "duration" }, "GIB DDOS Protocol": { "simple": "protocol" }, "GIB DDOS Request Body": { "simple": "requestData.body" }, "GIB DDOS Request Body Hash": { "simple": "requestData.bodyHash" }, "GIB DDOS Request Data Link": { "simple": "requestData.link" }, "GIB DDOS Request Headers Hash": { "simple": "requestData.headersHash" }, "GIB DDOS Source": { "simple": "source" }, "GIB DDOS Target ASN": { "simple": "target.asn" }, "GIB DDOS Target Category": { "simple": "target.category" }, "GIB DDOS Target City": { "simple": "target.city" }, "GIB DDOS Target Country Code": { "simple": "target.countryCode" }, "GIB DDOS Target Country Name": { "simple": "target.countryName" }, "GIB DDOS Target Domain": { "simple": "target.domain" }, "GIB DDOS Target IP": { "simple": "target.ip" }, "GIB DDOS Target Port": { "simple": "target.port" }, "GIB DDOS Target Provider": { "simple": "target.provider" }, "GIB DDOS Target Region": { "simple": "target.region" }, "GIB DDOS Target URL": { "simple": "target.url" }, "GIB DDOS Type": { "simple": "type" }, "GIB ID": { "simple": "id" }, "GIB Malware Name": { "simple": "malwareName" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actor ID": { "simple": "threatActor.id" }, "GIB Threat Actor Name": { "simple": "threatActor.name" }, "GIB Threat Actor is APT": { "simple": "threatActor.isAPT" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Attacks Deface": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Country Code": { "simple": "targetIp.countryCode" }, "GIB Country Name": { "simple": "targetIp.countryName" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Deface Contacts": { "simple": "contacts" }, "GIB Deface Date": { "simple": "date" }, "GIB Deface Site URL": { "simple": "siteUrl" }, "GIB Deface Source": { "simple": "source" }, "GIB ID": { "simple": "id" }, "GIB Mirror Link": { "simple": "mirrorLink" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Provider Domain": { "simple": "providerDomain" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "GIB Target ASN": { "simple": "targetIp.asn" }, "GIB Target City": { "simple": "targetIp.city" }, "GIB Target Domain": { "simple": "targetDomain" }, "GIB Target Domain Provider": { "simple": "targetDomainProvider" }, "GIB Target IP": { "simple": "targetIp.ip" }, "GIB Target Provider": { "simple": "targetIp.provider" }, "GIB Target Region": { "simple": "targetIp.region" }, "GIB Threat Actor ID": { "simple": "threatActor.id" }, "GIB Threat Actor Name": { "simple": "threatActor.name" }, "GIB Threat Actor is APT": { "simple": "threatActor.isAPT" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Attacks Phishing Group": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Country Name": { "simple": "phishing_ip.countryName" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB ID": { "simple": "id" }, "GIB Phishing Brand": { "simple": "brand" }, "GIB Phishing Date Added": { "simple": "added" }, "GIB Phishing Date Blocked": { "simple": "blocked" }, "GIB Phishing Date Detected": { "simple": "detected" }, "GIB Phishing Date Updated": { "simple": "updated" }, "GIB Phishing Domain": { "simple": "domainInfo.domain" }, "GIB Phishing Domain Expiration Date": { "simple": "domainInfo.expirationDate" }, "GIB Phishing Domain Puny": { "simple": "domainInfo.domainPuny" }, "GIB Phishing IP Table": { "simple": "phishing_ip" }, "GIB Phishing Kit Source": { "simple": "source" }, "GIB Phishing Kit Table": { "simple": "phishing_kit_table" }, "GIB Phishing Objectives": { "simple": "objective" }, "GIB Phishing Registrar": { "simple": "domainInfo.registrar" }, "GIB Phishing Sources": { "simple": "source" }, "GIB Phishing URLs": { "simple": "phishing_urls" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actor ID": { "simple": "threatActor.id" }, "GIB Threat Actor Name": { "simple": "threatActor.name" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Attacks Phishing Kit": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Data Hash": { "simple": "hash" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date of Detection": { "simple": "dateDetected" }, "GIB Downloaded From Table": { "simple": "downloadedFrom" }, "GIB ID": { "simple": "id" }, "GIB Phishing Kit Email": { "simple": "emails" }, "GIB Phishing Kit Source": { "simple": "source" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Compromised Account Group": { "dontMapEventToLabels": false, "internalMapping": { "GIB Address": { "simple": "person.address" }, "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Compromised Events Information Table": { "simple": "events_table" }, "GIB Compromised Login": { "simple": "login" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date First Compromised": { "simple": "dateFirstCompromised" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Compromised": { "simple": "dateLastCompromised" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date of Detection": { "simple": "person.dateDetected" }, "GIB Email": { "simple": "person.email" }, "GIB ID": { "simple": "id" }, "GIB Parsed Login Domain": { "simple": "parsedLogin.domain" }, "GIB Parsed Login IP": { "simple": "parsedLogin.ip" }, "GIB Password": { "simple": "password" }, "GIB Person": { "simple": "person.name" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Service Domain": { "simple": "service.domain" }, "GIB Service IP": { "simple": "service.ip" }, "GIB Service URL": { "simple": "service.url" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "Phone Number": { "simple": "person.phone" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Compromised Card Group": { "dontMapEventToLabels": false, "internalMapping": { "GIB Address": { "simple": "address" }, "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB CVV": { "simple": "cvv" }, "GIB Card Issuer": { "simple": "issuer" }, "GIB Card Number": { "simple": "number" }, "GIB Card Type": { "simple": "type" }, "GIB Card Valid Thru": { "simple": "validThru" }, "GIB Compromised Events Table": { "simple": "compromised_events" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date First Compromised": { "simple": "dateFirstCompromised" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Compromised": { "simple": "dateLastCompromised" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Email": { "simple": "email" }, "GIB ID": { "simple": "id" }, "GIB Malware Table": { "simple": "malware" }, "GIB Payment System": { "simple": "payment_system" }, "GIB Person": { "simple": "owner_name" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actors Table": { "simple": "threatActor" }, "Phone Number": { "simple": "phone" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Compromised Mule": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Compromised Account": { "simple": "account" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Data Hash": { "simple": "hash" }, "GIB Date Add": { "simple": "dateAdd" }, "GIB Date Incident": { "simple": "dateIncident" }, "GIB ID": { "simple": "id" }, "GIB Organization BIC": { "simple": "organization.bic" }, "GIB Organization BSB": { "simple": "organization.bsb" }, "GIB Organization CLABE": { "simple": "organization.clabe" }, "GIB Organization IBAN": { "simple": "organization.iban" }, "GIB Organization Name": { "simple": "organization.name" }, "GIB Organization SWIFT": { "simple": "organization.swift" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Cybercriminal Threat": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Cybercriminal Expertises": { "simple": "expertise" }, "GIB Cybercriminal Forums Table": { "simple": "forumsAccounts" }, "GIB Cybercriminal Regions": { "simple": "regions" }, "GIB Cybercriminal Sectors": { "simple": "sectors" }, "GIB Cybercriminal Threat Description": { "simple": "description" }, "GIB Cybercriminal Threat Title": { "simple": "title" }, "GIB Date Created At": { "simple": "createdAt" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB ID": { "simple": "id" }, "GIB Is Tailored": { "simple": "isTailored" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Report Number": { "simple": "reportNumber" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actor Country": { "simple": "threatActor.country" }, "GIB Threat Actor ID": { "simple": "threatActor.id" }, "GIB Threat Actor Name": { "simple": "threatActor.name" }, "GIB Threat Actor is APT": { "simple": "threatActor.isAPT" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Cybercriminal Threat Actor": { "dontMapEventToLabels": false, "internalMapping": { "GIB Cybercriminal Expertises": { "simple": "expertise" }, "GIB Cybercriminal Malware": { "simple": "malware" }, "GIB Cybercriminal Regions": { "simple": "regions" }, "GIB Cybercriminal Sectors": { "simple": "sectors" }, "GIB Cybercriminal Threat Actor Aliases": { "simple": "aliases" }, "GIB Cybercriminal Threat Actor Description": { "simple": "description" }, "GIB Cybercriminal Threat Actor Reports Table": { "simple": "reports" }, "GIB Date Created At": { "simple": "createdAt" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date Updated At": { "simple": "updatedAt" }, "GIB ID": { "simple": "id" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actor Name": { "simple": "threat_actor_name" }, "GIB Threat Actor is APT": { "simple": "isAPT" }, "severity": { "simple": "systemSeverity" } } }, "GIB Malware": { "dontMapEventToLabels": false, "internalMapping": { "GIB Date Updated At": { "simple": "updatedAt" }, "GIB ID": { "simple": "id" }, "GIB Malware Aliases": { "simple": "aliases" }, "GIB Malware Categories": { "simple": "category" }, "GIB Malware Description": { "simple": "description" }, "GIB Malware Langs": { "simple": "langs" }, "GIB Malware Name": { "simple": "malware_name" }, "GIB Malware Platforms": { "simple": "platform" }, "GIB Malware Regions": { "simple": "geoRegion" }, "GIB Malware Short Description": { "simple": "shortDescription" }, "GIB Malware Source Countries": { "simple": "sourceCountry" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actor ID": { "simple": "taList.id" }, "GIB Threat Actor Name": { "simple": "taList.name" }, "GIB Threat Actors Table": { "simple": "taList" }, "GIB Threat Level": { "simple": "threatLevel" } } }, "GIB Malware CNC": { "dontMapEventToLabels": false, "internalMapping": { "GIB CNC URL": { "simple": "cnc" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date of Detection": { "simple": "dateDetected" }, "GIB ID": { "simple": "id" }, "GIB Malware CNC Domain": { "simple": "domain" }, "GIB Malware Table": { "simple": "malwareList" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actors Table": { "simple": "threatActor" } } }, "GIB Nation-State Cybercriminals Threat": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date Created At": { "simple": "createdAt" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date Published": { "simple": "datePublished" }, "GIB ID": { "simple": "id" }, "GIB Is Tailored": { "simple": "isTailored" }, "GIB Nation-State Cybercriminal Forums Table": { "simple": "forumsAccounts" }, "GIB Nation-State Cybercriminals Threat Actor Labels": { "simple": "labels" }, "GIB Nation-State Cybercriminals Threat Countries": { "simple": "countries" }, "GIB Nation-State Cybercriminals Threat Description": { "simple": "description" }, "GIB Nation-State Cybercriminals Threat Expertises": { "simple": "expertise" }, "GIB Nation-State Cybercriminals Threat Langs": { "simple": "langs" }, "GIB Nation-State Cybercriminals Threat Regions": { "simple": "regions" }, "GIB Nation-State Cybercriminals Threat Report Number": { "simple": "reportNumber" }, "GIB Nation-State Cybercriminals Threat Sectors": { "simple": "sectors" }, "GIB Nation-State Cybercriminals Threat Title": { "simple": "title" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actor Country": { "simple": "threatActor.country" }, "GIB Threat Actor ID": { "simple": "threatActor.id" }, "GIB Threat Actor Name": { "simple": "threatActor.name" }, "GIB Threat Actor is APT": { "simple": "threatActor.isAPT" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Nation-State Cybercriminals Threat Actor": { "dontMapEventToLabels": false, "internalMapping": { "GIB Date Created At": { "simple": "createdAt" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date Updated At": { "simple": "updatedAt" }, "GIB ID": { "simple": "id" }, "GIB Nation-State Cybercriminals Expertises": { "simple": "expertise" }, "GIB Nation-State Cybercriminals Malware": { "simple": "malware" }, "GIB Nation-State Cybercriminals Regions": { "simple": "regions" }, "GIB Nation-State Cybercriminals Sectors": { "simple": "sectors" }, "GIB Nation-State Cybercriminals Threat Actor Aliases": { "simple": "aliases" }, "GIB Nation-State Cybercriminals Threat Actor CVE": { "simple": "cve" }, "GIB Nation-State Cybercriminals Threat Actor Country": { "simple": "country" }, "GIB Nation-State Cybercriminals Threat Actor Description": { "simple": "description" }, "GIB Nation-State Cybercriminals Threat Actor Goals": { "simple": "goals" }, "GIB Nation-State Cybercriminals Threat Actor Labels": { "simple": "labels" }, "GIB Nation-State Cybercriminals Threat Actor Reports Table": { "simple": "reports" }, "GIB Nation-State Cybercriminals Threat Actor Roles": { "simple": "roles" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actor Name": { "simple": "threat_actor_name" }, "GIB Threat Actor is APT": { "simple": "isAPT" }, "severity": { "simple": "systemSeverity" } } }, "GIB OSI Vulnerability": { "dontMapEventToLabels": false, "internalMapping": { "Description": { "simple": "description" }, "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Affected Software Table": { "simple": "affectedSoftware" }, "GIB Bulletin Family": { "simple": "bulletinFamily" }, "GIB CPE Table": { "simple": "cpeTable" }, "GIB CVSS Score": { "simple": "cvss.score" }, "GIB CVSS Vector": { "simple": "cvss.vector" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date Modified": { "simple": "dateModified" }, "GIB Date Published": { "simple": "datePublished" }, "GIB Extended CVSS Base": { "simple": "extCvss.base" }, "GIB Extended CVSS Exploitability": { "simple": "extCvss.exploitability" }, "GIB Extended CVSS Impact": { "simple": "extCvss.impact" }, "GIB Extended CVSS Overall": { "simple": "extCvss.overall" }, "GIB Extended CVSS Temporal": { "simple": "extCvss.temporal" }, "GIB Extended Description": { "simple": "extDescription" }, "GIB Has Exploit": { "simple": "hasExploit" }, "GIB Href": { "simple": "href" }, "GIB ID": { "simple": "id" }, "GIB Merged Cvss": { "simple": "mergedCvss" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Reporter": { "simple": "reporter" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "GIB Vulnerability Type": { "simple": "type" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Suspicious IP Open Proxy": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date of Detection": { "simple": "dateDetected" }, "GIB ID": { "simple": "id" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Proxy Port": { "simple": "port" }, "GIB Proxy Source": { "simple": "source" }, "GIB Proxy Sources": { "simple": "sources" }, "GIB Proxy Type": { "simple": "type" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Suspicious IP Scanner": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB ID": { "simple": "id" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Scanner Categories": { "simple": "categories" }, "GIB Scanner Sources": { "simple": "sources" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Suspicious IP Socks Proxy": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB Date of Detection": { "simple": "dateDetected" }, "GIB ID": { "simple": "id" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Socks Proxy Source": { "simple": "source" }, "GIB Source": { "simple": "sourceType" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Suspicious IP TOR Node": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB ID": { "simple": "id" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Suspicious IP VPN": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date First Seen": { "simple": "dateFirstSeen" }, "GIB Date Last Seen": { "simple": "dateLastSeen" }, "GIB ID": { "simple": "id" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB Source": { "simple": "sourceType" }, "GIB VPN Names": { "simple": "names" }, "GIB VPN Sources": { "simple": "sources" }, "severity": { "simple": "systemSeverity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } } } }, "Indicator Feed": { "dontMapEventToLabels": false, "internalMapping": { "Country": { "complex": { "accessor": "[0]", "filters": [], "root": "countries", "transformers": [] } }, "Target": { "complex": { "accessor": "[0]", "filters": [], "root": "targetedCompany", "transformers": [] } }, "name": { "complex": { "filters": [], "root": "title", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "evaluation", "transformers": [] } } } }, "GIB Compromised Masked Card": { "dontMapEventToLabels": true, "internalMapping": { "GIB ID": { "simple": "id" }, "GIB Base Name": { "simple": "baseName" }, "GIB Card BIN": { "simple": "card_bin" }, "GIB CVV": { "simple": "cvv" }, "GIB Card Dump": { "simple": "card_dump" }, "GIB Card Issuer Country Code": { "simple": "issuer_country_code" }, "GIB Card Issuer Country Name": { "simple": "issuer_country_name" }, "GIB Card Issuer": { "simple": "issuer" }, "GIB Card Number": { "simple": "number" }, "GIB Card PIN": { "simple": "card_pin" }, "GIB Payment System": { "simple": "payment_system" }, "GIB Card Category": { "simple": "card_category" }, "GIB Card Type": { "simple": "type" }, "GIB Card Valid Thru": { "simple": "validThru" }, "GIB Card Valid Thru Date": { "simple": "validThruDate" }, "GIB Client ASN": { "simple": "client_asn" }, "GIB Client City": { "simple": "client_city" }, "GIB Client Region": { "simple": "client_region" }, "GIB Client Provider": { "simple": "client_provider" }, "GIB Client Country Code": { "simple": "client_country_code" }, "GIB Client Country Name": { "simple": "client_country_name" }, "GIB Client IP": { "simple": "client_ip" }, "GIB CNC": { "simple": "cnc" }, "GIB CNC Domain": { "simple": "cnc_domain" }, "GIB CNC IP": { "simple": "cnc_ip" }, "GIB CNC ASN": { "simple": "cnc_asn" }, "GIB CNC City": { "simple": "cnc_city" }, "GIB CNC Region": { "simple": "cnc_region" }, "GIB CNC Provider": { "simple": "cnc_provider" }, "GIB CNC Country Code": { "simple": "cnc_country_code" }, "GIB CNC Country Name": { "simple": "cnc_country_name" }, "GIB CNC URL": { "simple": "cnc_url" }, "GIB Date of Detection": { "simple": "dateDetected" }, "GIB Date Compromised": { "simple": "dateCompromised" }, "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB TLP": { "complex": { "accessor": "tlp", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB TTL": { "complex": { "accessor": "ttl", "filters": [], "root": "evaluation", "transformers": [] } }, "GIB Is Dump": { "simple": "isDump" }, "GIB Is Expired": { "simple": "isExpired" }, "GIB Is Masked": { "simple": "isMasked" }, "GIB Malware Name": { "simple": "malware_name" }, "GIB Malware ID": { "simple": "malware_id" }, "GIB Malware STIX GUID": { "simple": "malware_stix_guid" }, "GIB Address": { "simple": "address" }, "GIB Owner Birthday": { "simple": "owner_birthday" }, "GIB Owner Country Code": { "simple": "owner_country_code" }, "GIB Email": { "simple": "email" }, "GIB Person": { "simple": "owner_name" }, "GIB Owner Passport": { "simple": "owner_passport" }, "Phone Number": { "simple": "phone" }, "GIB Owner State": { "simple": "owner_state" }, "GIB Owner Tax Number": { "simple": "owner_tax_number" }, "GIB Owner ZIP": { "simple": "owner_zip" }, "GIB Owner City": { "simple": "owner_city" }, "GIB Price Currency": { "simple": "price_currency" }, "GIB Price Value": { "simple": "price_value" }, "GIB Source Link": { "simple": "sourceLink" }, "GIB Source": { "simple": "sourceType" }, "GIB Threat Actor Name": { "simple": "threat_actor_name" }, "GIB Threat Actor ID": { "simple": "threat_actor_id" }, "GIB Threat Actor STIX GUID": { "simple": "threat_actor_stix_guid" }, "GIB Threat Actor is APT": { "simple": "threat_actor_is_apt" }, "GIB Threat Actor Country": { "simple": "threat_actor_country" }, "GIB Track": { "simple": "track" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Related Indicators Data": { "simple": "indicators" }, "severity": { "simple": "systemSeverity" } } }, "GIB SPD": { "dontMapEventToLabels": false, "internalMapping": { "GIB Admiralty Code": { "simple": "evaluation.admiraltyCode" }, "GIB Credibility": { "simple": "evaluation.credibility" }, "GIB Date Created At": { "simple": "createdAt" }, "GIB Date First Seen": { "simple": "firstSeenAt" }, "GIB Date Last Seen": { "simple": "lastSeenAt" }, "GIB ID": { "simple": "id" }, "GIB SPD Events Table": { "simple": "events" }, "GIB SPD Illegal Score": { "simple": "illegalScore" }, "GIB SPD Malware Table": { "simple": "malware" }, "GIB SPD Owner Name": { "simple": "ownerName" }, "GIB Portal Link": { "simple": "portalLink" }, "GIB Reliability": { "simple": "evaluation.reliability" }, "GIB SPD Service Type": { "simple": "serviceType" }, "GIB Severity": { "simple": "evaluation.severity" }, "GIB SPD Sources Table": { "simple": "sources" }, "GIB SPD Threat Actor Table": { "simple": "threatActor" }, "GIB TLP": { "simple": "evaluation.tlp" }, "GIB TTL": { "simple": "evaluation.ttl" }, "GIB SPD Type": { "simple": "type" }, "GIB SPD Value": { "simple": "value" }, "severity": { "simple": "systemSeverity" } } } }, "name": "Group-IB Threat Intelligence (mapper)", "type": "mapping-incoming", "version": -1, "fromVersion": "6.0.0" }