{
    "description": "Default Mapping for Qradar Offenses, Events, and Assets.",
    "feed": false,
    "id": "QRadar - Generic Incoming Mapper",
    "mapping": {
        "Access": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Dest NT Domain": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "destination_networks",
                        "transformers": [
                            {
                                "args": {
                                    "separator": {
                                        "isContext": false,
                                        "value": null
                                    }
                                },
                                "operator": "join"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Src NT Domain": {
                    "complex": null,
                    "simple": "source_network"
                },
                "Src User": {
                    "complex": null,
                    "simple": "offense_source"
                },
                "details": {
                    "complex": null,
                    "simple": "description"
                },
                "occurred": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "start_time",
                        "transformers": []
                    },
                    "simple": ""
                }
            }
        },
        "Qradar Generic": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Asset Table": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "assets",
                        "transformers": []
                    },
                    "simple": ""
                },
                "Assigned User": {
                    "complex": null,
                    "simple": "assigned_to"
                },
                "CVSS Availability Requirement": {
                    "complex": {
                        "accessor": "CVSS Availability Requirement",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "CVSS Collateral Damage Potential": {
                    "complex": {
                        "accessor": "CVSS Collateral Damage Potential",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "CVSS Confidentiality Requirement": {
                    "complex": {
                        "accessor": "CVSS Confidentiality Requirement",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "CVSS Integrity Requirement": {
                    "complex": {
                        "accessor": "CVSS Integrity Requirement",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Category Count": {
                    "complex": null,
                    "simple": "category_count"
                },
                "Close Time": {
                    "complex": null,
                    "simple": "close_time"
                },
                "Closing Reason": {
                    "complex": null,
                    "simple": "closing_reason_id"
                },
                "Closing User": {
                    "complex": null,
                    "simple": "closing_user"
                },
                "Compliance Notes": {
                    "complex": {
                        "accessor": "Compliance Notes",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Credibility - Offense": {
                    "complex": null,
                    "simple": "credibility"
                },
                "DNS Name": {
                    "complex": {
                        "accessor": "Unified Name",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Description - Asset": {
                    "complex": {
                        "accessor": "Description",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Description - Offense": {
                    "complex": null,
                    "simple": "description"
                },
                "Destination Geolocation": {
                    "complex": {
                        "accessor": "destinationgeographiclocation",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Destination IP - Offense": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "local_destination_address_ids",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Destination IPV6": {
                    "complex": {
                        "accessor": "destinationv6",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Destination IPs": {
                    "complex": {
                        "accessor": "destinationip",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Destination MAC Address": {
                    "complex": {
                        "accessor": "destinationMAC",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Destination Network - Offense": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "destination_networks",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Device Time": {
                    "complex": {
                        "accessor": "devicetime",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Domain - Offense": {
                    "complex": null,
                    "simple": "domain_name"
                },
                "Dst Ports": {
                    "complex": {
                        "accessor": "destinationport",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Event Descriptions": {
                    "complex": {
                        "accessor": "qiddescription_qid",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Event Names": {
                    "complex": {
                        "accessor": "qidname_qid",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Events": {
                    "complex": null,
                    "simple": "events"
                },
                "Follow Up": {
                    "complex": null,
                    "simple": "follow_up"
                },
                "High Level Categories": {
                    "complex": {
                        "accessor": "categoryname_highlevelcategory",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "ID - Asset": {
                    "complex": {
                        "accessor": "id",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "ID - Offense": {
                    "complex": null,
                    "simple": "id"
                },
                "IP Address - Asset": {
                    "complex": {
                        "accessor": "value",
                        "filters": [],
                        "root": "assets.interfaces.ip_addresses",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "IncomingMirrorError": {
                    "complex": null,
                    "simple": "mirroring_events_message"
                },
                "Last Mirrored Time Stamp": {
                    "complex": null,
                    "simple": "last_mirror_in_time"
                },
                "Last Update Time": {
                    "complex": null,
                    "simple": "last_updated_time"
                },
                "External Last Updated Time": {
                    "complex": null,
                    "simple": "last_updated_time"
                },
                "Link To Offense": {
                    "complex": null,
                    "simple": "LinkToOffense"
                },
                "List Of Rules - Event": {
                    "complex": {
                        "accessor": "rulename_creeventlist",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "List of Rules - Offense": {
                    "complex": null,
                    "simple": "rules.name"
                },
                "Location - Asset": {
                    "complex": {
                        "accessor": "Location",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Log Source Name": {
                    "complex": {
                        "accessor": "logsourcename_logsourceid",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Log Source Type": {
                    "complex": {
                        "accessor": "logsourcetypename_devicetype",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Low Level Categories - Offense": {
                    "complex": null,
                    "simple": "categories"
                },
                "Low Level Categories Events": {
                    "complex": {
                        "accessor": "categoryname_category",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "MAC Address - Asset": {
                    "complex": {
                        "accessor": "mac_address",
                        "filters": [],
                        "root": "assets.interfaces",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Magnitude - Offense": {
                    "complex": null,
                    "simple": "magnitude"
                },
                "Number Of Events In Offense": {
                    "complex": null,
                    "simple": "event_count"
                },
                "Number Of Fetched Events": {
                    "complex": null,
                    "simple": "events_fetched"
                },
                "Number Of Flows": {
                    "complex": null,
                    "simple": "flow_count"
                },
                "Number Of Log Sources": {
                    "complex": null,
                    "simple": "device_count"
                },
                "Offense Inactive": {
                    "complex": null,
                    "simple": "inactive"
                },
                "Post Nat Destination IP": {
                    "complex": {
                        "accessor": "postNatDestinationIP",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Post Nat Destination Port": {
                    "complex": {
                        "accessor": "postNatDestinationPort",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Post Nat Source IP": {
                    "complex": {
                        "accessor": "postNatSourceIP",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Post Nat Source Port": {
                    "complex": {
                        "accessor": "postNatSourcePort",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Pre Nat Destination Port": {
                    "complex": {
                        "accessor": "preNatDestinationPort",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Pre Nat Source IP": {
                    "complex": {
                        "accessor": "preNatSourceIP",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Pre Nat Source Port": {
                    "complex": {
                        "accessor": "preNatSourcePort",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Protocol": {
                    "complex": {
                        "accessor": "protocolname_protocolid",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Protocol - Event": {
                    "complex": {
                        "accessor": "protocolname_protocolid",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Raw Event": {
                    "complex": {
                        "accessor": "utf8_payload",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Relevance - Offense": {
                    "complex": null,
                    "simple": "relevance"
                },
                "Severity - Offense": {
                    "complex": null,
                    "simple": "severity"
                },
                "Source Geolocation": {
                    "complex": {
                        "accessor": "sourcegeographiclocation",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Source IP - Offense": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "source_address_ids",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Source IPV6": {
                    "complex": {
                        "accessor": "sourcev6",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Source IPs": {
                    "complex": {
                        "accessor": "sourceip",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Source MAC Address": {
                    "complex": {
                        "accessor": "sourceMAC",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Src Ports": {
                    "complex": {
                        "accessor": "sourceport",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Start Time": {
                    "complex": null,
                    "simple": "start_time"
                },
                "External Start Time": {
                    "complex": null,
                    "simple": "start_time"
                },
                "Status - Offense": {
                    "complex": null,
                    "simple": "status"
                },
                "Switch ID - Asset": {
                    "complex": {
                        "accessor": "Switch ID",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Switch Port ID - Asset": {
                    "complex": {
                        "accessor": "Switch Port ID",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Technical Owner": {
                    "complex": {
                        "accessor": "Technical Owner",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Technical Owner Contact": {
                    "complex": {
                        "accessor": "Technical Contact",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Technical User": {
                    "complex": {
                        "accessor": "Technical User",
                        "filters": [],
                        "root": "assets",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Traffic Direction": {
                    "complex": {
                        "accessor": "eventDirection",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Type - Offense": {
                    "complex": null,
                    "simple": "offense_type"
                },
                "Username": {
                    "complex": {
                        "accessor": "username",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "Username Count - Offense": {
                    "complex": null,
                    "simple": "username_count"
                },
                "Usernames": {
                    "complex": {
                        "accessor": "username",
                        "filters": [],
                        "root": "events",
                        "transformers": [
                            {
                                "args": {},
                                "operator": "uniq"
                            }
                        ]
                    },
                    "simple": ""
                },
                "severity": {
                    "complex": {
                        "accessor": "",
                        "filters": [],
                        "root": "magnitude",
                        "transformers": [
                            {
                                "args": {
                                    "input_values": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "1,2,3,4,5,6,7,8,9,10"
                                        }
                                    },
                                    "mapped_values": {
                                        "isContext": false,
                                        "value": {
                                            "complex": null,
                                            "simple": "1,1,1,2,2,2,2,3,3,3"
                                        }
                                    }
                                },
                                "operator": "MapValuesTransformer"
                            }
                        ]
                    },
                    "simple": ""
                }
            }
        },
        "dbot_classification_incident_type_all": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "dbotMirrorDirection": {
                    "complex": null,
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "complex": null,
                    "simple": "id"
                },
                "dbotMirrorInstance": {
                    "complex": null,
                    "simple": "mirror_instance"
                },
                "name": {
                    "complex": {
                        "filters": [],
                        "root": "id",
                        "transformers": [
                            {
                                "args": {
                                    "prefix": {
                                        "isContext": false
                                    },
                                    "suffix": {
                                        "isContext": false,
                                        "value": {
                                            "simple": " "
                                        }
                                    }
                                },
                                "operator": "concat"
                            },
                            {
                                "args": {
                                    "prefix": {
                                        "isContext": false
                                    },
                                    "suffix": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "description"
                                        }
                                    }
                                },
                                "operator": "concat"
                            }
                        ]
                    }
                }
            }
        }
    },
    "name": "QRadar - Generic Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.0.0",
    "supportedModules": [
        "agentix",
        "xsiam"
    ]
}