{
    "description": "",
    "feed": false,
    "id": "Hurukai - Incoming mapper",
    "mapping": {
        "Hurukai alert": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Agent ID": {
                    "complex": {
                        "accessor": "agentid",
                        "filters": [],
                        "root": "agent",
                        "transformers": []
                    }
                },
                "Agent Version": {
                    "simple": "agent.version"
                },
                "Alert Category": {
                    "simple": "alert_type"
                },
                "Alert ID": {
                    "simple": "id"
                },
                "Alert Name": {
                    "simple": "rule_name"
                },
                "Alert Source": {
                    "simple": "detection_origin"
                },
                "Alert Type ID": {
                    "simple": "alert_type"
                },
                "Categories": {
                    "simple": "alert_type"
                },
                "Command Line": {
                    "simple": "process.commandline"
                },
                "Description": {
                    "simple": "msg"
                },
                "Device Name": {
                    "simple": "agent.hostname"
                },
                "Domain Name": {
                    "simple": "agent.domainname"
                },
                "Endpoint": {
                    "simple": "agent.hostname"
                },
                "Event ID": {
                    "simple": "eventlog.event_id"
                },
                "Event Type": {
                    "simple": "eventlog.type"
                },
                "Incident Link": {
                    "simple": "incident_link"
                },
                "Log Source": {
                    "simple": "eventlog.source_name"
                },
                "MD5": {
                    "simple": "process.hashes.md5"
                },
                "OS": {
                    "simple": "agent.osproducttype"
                },
                "OS Type": {
                    "simple": "agent.ostype"
                },
                "OS Version": {
                    "simple": "agent.osversion"
                },
                "PID": {
                    "simple": "process.pid"
                },
                "Parent CMD line": {
                    "simple": "process.parent_commandline"
                },
                "Parent Process File Path": {
                    "simple": "process.parent_image"
                },
                "Process Creation Time": {
                    "simple": "process.create_time"
                },
                "Process Name": {
                    "simple": "process.process_name"
                },
                "Process Path": {
                    "simple": "process.image_name"
                },
                "Registry Key": {
                    "simple": "details_registry.target_object"
                },
                "Rule Name": {
                    "simple": "rule_name"
                },
                "SHA1": {
                    "simple": "process.hashes.sha1"
                },
                "SHA256": {
                    "simple": "process.hashes.sha256"
                },
                "Sub Category": {
                    "simple": "alert_subtype"
                },
                "Tags": {
                    "simple": "tags"
                },
                "Tenant Name": {
                    "simple": "tenant"
                },
                "HarfangLab EDR Threat ID": {
                    "simple": "threat_key"
                },
                "User SID": {
                    "simple": "process.usersid"
                },
                "dbotMirrorDirection": {
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "complex": {
                        "filters": [],
                        "root": "id",
                        "transformers": [
                            {
                                "args": {
                                    "prefix": {
                                        "isContext": false,
                                        "value": {
                                            "simple": "sec:"
                                        }
                                    },
                                    "suffix": {
                                        "isContext": false
                                    }
                                },
                                "operator": "concat"
                            }
                        ]
                    }
                },
                "dbotMirrorInstance": {
                    "simple": "mirror_instance"
                }
            }
        },
        "Hurukai threat": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Agents ID": {
                    "simple": "agents.id"
                },
                "HarfangLab EDR Total Security Event Count": {
                    "simple": "total_security_event_count"
                },
                "HarfangLab EDR Critical Security Event Count": {
                    "simple": "security_event_count_by_level.critical"
                },
                "Description": {
                    "simple": "note.content"
                },
                "HarfangLab EDR High Security Event Count": {
                    "simple": "security_event_count_by_level.high"
                },
                "HarfangLab EDR Medium Security Event Count": {
                    "simple": "security_event_count_by_level.medium"
                },
                "HarfangLab EDR Low Security Event Count": {
                    "simple": "security_event_count_by_level.low"
                },
                "MITRE Tactic Name": {
                    "simple": "mitre_tactics"
                },
                "First Seen": {
                    "simple": "first_seen"
                },
                "Hostnames": {
                    "simple": "agents.agent_hostname"
                },
                "Incident Link": {
                    "simple": "incident_link"
                },
                "Last Seen": {
                    "simple": "last_seen"
                },
                "Rule Name": {
                    "simple": "rules.rule_name"
                },
                "HarfangLab EDR Threat ID": {
                    "simple": "id"
                },
                "HarfangLab EDR Top Agents": {
                    "simple": "top_agents.agent_hostname"
                },
                "HarfangLab EDR Top Impacted Users": {
                    "simple": "top_impacted_users.user_name"
                },
                "HarfangLab EDR Top Rules": {
                    "simple": "top_rules.rule_name"
                },
                "Users": {
                    "simple": "impacted_users.full_name"
                },
                "details": {
                    "simple": "note.content"
                },
                "dbotMirrorDirection": {
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "complex": {
                        "filters": [],
                        "root": "id",
                        "transformers": [
                            {
                                "args": {
                                    "prefix": {
                                        "isContext": false,
                                        "value": {
                                            "simple": "thr:"
                                        }
                                    },
                                    "suffix": {
                                        "isContext": false
                                    }
                                },
                                "operator": "concat"
                            }
                        ]
                    }
                },
                "dbotMirrorInstance": {
                    "simple": "mirror_instance"
                },
                "dbotMirrorTags": {
                    "complex": null,
                    "simple": "mirror_tags"
                }
            }
        }
    },
    "name": "Hurukai - Incoming mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.2.0"
}