{ "id": "RedLock-mapper", "name": "Prisma Cloud - Incoming Mapper", "type": "mapping-incoming", "description": "Maps incoming Prisma Cloud event fields that are created through the 'fetch incidents' command in the Prisma Cloud integration.", "defaultIncidentType": "Prisma Cloud", "mapping": { "AWS CloudTrail Misconfiguration": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "complex": { "accessor": "accountId", "filters": [], "root": "resource", "transformers": [] } }, "Account Name": { "complex": { "accessor": "account", "filters": [], "root": "resource", "transformers": [] } }, "Alert ID": { "simple": "id" }, "First Seen": { "complex": { "filters": [], "root": "firstSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "Last Modified By": { "complex": { "accessor": "lastModifiedBy", "filters": [], "root": "policy", "transformers": [] } }, "Last Modified On": { "complex": { "accessor": "lastModifiedOn", "filters": [], "root": "policy", "transformers": [] } }, "Last Seen": { "complex": { "filters": [], "root": "lastSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Last Update Time": { "complex": { "filters": [], "root": "lastUpdated", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Policy Deleted": { "complex": { "accessor": "deleted", "filters": [], "root": "policy", "transformers": [] } }, "Policy Description": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "Policy ID": { "complex": { "accessor": "policyId", "filters": [], "root": "policy", "transformers": [] } }, "Policy Recommendation": { "complex": { "accessor": "recommendation", "filters": [], "root": "policy", "transformers": [] } }, "Policy Remediable": { "complex": { "accessor": "remediable", "filters": [], "root": "policy", "transformers": [] } }, "Policy Severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "Policy Type": { "complex": { "accessor": "policyType", "filters": [], "root": "policy", "transformers": [] } }, "Prisma Cloud ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "Prisma Cloud Reason": { "complex": { "filters": [], "root": "reason", "transformers": [] } }, "Prisma Cloud Rules": { "complex": { "filters": [], "root": "alertRules", "transformers": [ { "operator": "ConvertKeysToTableFieldFormat" } ] } }, "Prisma Cloud Status": { "complex": { "filters": [], "root": "status", "transformers": [] } }, "Prisma Cloud Dismissal Note": { "complex": { "filters": [], "root": "dismissalNote", "transformers": [] } }, "Prisma Cloud Time": { "complex": { "filters": [], "root": "alertTime", "transformers": [] } }, "RRN": { "simple": "resource.rrn" }, "Region": { "complex": { "accessor": "region", "filters": [], "root": "resource", "transformers": [] } }, "Resource API Name": { "complex": { "accessor": "resourceApiName", "filters": [], "root": "resource", "transformers": [] } }, "Resource Cloud Type": { "complex": { "accessor": "cloudType", "filters": [], "root": "resource", "transformers": [] } }, "Resource ID": { "complex": { "accessor": "id", "filters": [], "root": "resource", "transformers": [] } }, "Resource Name": { "complex": { "accessor": "name", "filters": [], "root": "resource", "transformers": [] } }, "Resource Type": { "complex": { "accessor": "resourceType", "filters": [], "root": "resource", "transformers": [] } }, "Risk Rating": { "complex": { "accessor": "rating", "filters": [], "root": "riskDetail", "transformers": [] } }, "Risk Score": { "complex": { "accessor": "score", "filters": [], "root": "riskDetail", "transformers": [] } }, "SKU Name": { "complex": { "accessor": "data.sku.name", "filters": [], "root": "resource", "transformers": [] } }, "SKU TIER": { "complex": { "accessor": "data.sku.tier", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Assigned By": { "complex": { "accessor": "data.properties.metadata.assignedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created By": { "complex": { "accessor": "data.properties.metadata.createdBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created On": { "complex": { "accessor": "data.properties.metadata.createdOn", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Description": { "complex": { "accessor": "data.properties.description", "filters": [], "root": "resource", "transformers": [] } }, "Subscription ID": { "complex": { "accessor": "data.id", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Name": { "complex": { "accessor": "data.name", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Type": { "complex": { "accessor": "data.type", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated By": { "complex": { "accessor": "data.properties.metadata.updatedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated On": { "complex": { "accessor": "data.properties.metadata.updatedOn", "filters": [], "root": "resource", "transformers": [] } }, "System Default": { "complex": { "accessor": "systemDefault", "filters": [], "root": "policy", "transformers": [] } }, "Vendor Product": { "simple": "Prisma Cloud" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "details": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "name": { "complex": { "accessor": "name", "filters": [], "root": "policy", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "sourceBrand": { "simple": "\"Prisma Cloud\"" } } }, "AWS EC2 Instance Misconfiguration": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "complex": { "accessor": "accountId", "filters": [], "root": "resource", "transformers": [] } }, "Account Name": { "complex": { "accessor": "account", "filters": [], "root": "resource", "transformers": [] } }, "Alert ID": { "simple": "id" }, "First Seen": { "complex": { "filters": [], "root": "firstSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "Last Modified By": { "complex": { "accessor": "lastModifiedBy", "filters": [], "root": "policy", "transformers": [] } }, "Last Modified On": { "complex": { "accessor": "lastModifiedOn", "filters": [], "root": "policy", "transformers": [] } }, "Last Seen": { "complex": { "filters": [], "root": "lastSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Last Update Time": { "complex": { "filters": [], "root": "lastUpdated", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Policy Deleted": { "complex": { "accessor": "deleted", "filters": [], "root": "policy", "transformers": [] } }, "Policy Description": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "Policy ID": { "complex": { "accessor": "policyId", "filters": [], "root": "policy", "transformers": [] } }, "Policy Recommendation": { "complex": { "accessor": "recommendation", "filters": [], "root": "policy", "transformers": [] } }, "Policy Remediable": { "complex": { "accessor": "remediable", "filters": [], "root": "policy", "transformers": [] } }, "Policy Severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "Policy Type": { "complex": { "accessor": "policyType", "filters": [], "root": "policy", "transformers": [] } }, "Prisma Cloud ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "Prisma Cloud Reason": { "complex": { "filters": [], "root": "reason", "transformers": [] } }, "Prisma Cloud Rules": { "complex": { "filters": [], "root": "alertRules", "transformers": [ { "operator": "ConvertKeysToTableFieldFormat" } ] } }, "Prisma Cloud Status": { "complex": { "filters": [], "root": "status", "transformers": [] } }, "Prisma Cloud Dismissal Note": { "complex": { "filters": [], "root": "dismissalNote", "transformers": [] } }, "Prisma Cloud Time": { "complex": { "filters": [], "root": "alertTime", "transformers": [] } }, "RRN": { "simple": "resource.rrn" }, "Region": { "complex": { "accessor": "region", "filters": [], "root": "resource", "transformers": [] } }, "Resource API Name": { "complex": { "accessor": "resourceApiName", "filters": [], "root": "resource", "transformers": [] } }, "Resource Cloud Type": { "complex": { "accessor": "cloudType", "filters": [], "root": "resource", "transformers": [] } }, "Resource ID": { "complex": { "accessor": "id", "filters": [], "root": "resource", "transformers": [] } }, "Resource Name": { "complex": { "accessor": "name", "filters": [], "root": "resource", "transformers": [] } }, "Resource Type": { "complex": { "accessor": "resourceType", "filters": [], "root": "resource", "transformers": [] } }, "Risk Rating": { "complex": { "accessor": "rating", "filters": [], "root": "riskDetail", "transformers": [] } }, "Risk Score": { "complex": { "accessor": "score", "filters": [], "root": "riskDetail", "transformers": [] } }, "SKU Name": { "complex": { "accessor": "data.sku.name", "filters": [], "root": "resource", "transformers": [] } }, "SKU TIER": { "complex": { "accessor": "data.sku.tier", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Assigned By": { "complex": { "accessor": "data.properties.metadata.assignedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created By": { "complex": { "accessor": "data.properties.metadata.createdBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created On": { "complex": { "accessor": "data.properties.metadata.createdOn", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Description": { "complex": { "accessor": "data.properties.description", "filters": [], "root": "resource", "transformers": [] } }, "Subscription ID": { "complex": { "accessor": "data.id", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Name": { "complex": { "accessor": "data.name", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Type": { "complex": { "accessor": "data.type", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated By": { "complex": { "accessor": "data.properties.metadata.updatedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated On": { "complex": { "accessor": "data.properties.metadata.updatedOn", "filters": [], "root": "resource", "transformers": [] } }, "System Default": { "complex": { "accessor": "systemDefault", "filters": [], "root": "policy", "transformers": [] } }, "Vendor Product": { "simple": "Prisma Cloud" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "details": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "name": { "complex": { "accessor": "name", "filters": [], "root": "policy", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "sourceBrand": { "simple": "\"Prisma Cloud\"" } } }, "AWS IAM Policy Misconfiguration": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "complex": { "accessor": "accountId", "filters": [], "root": "resource", "transformers": [] } }, "Account Name": { "complex": { "accessor": "accountname", "filters": [], "root": "resource", "transformers": [] } }, "Alert ID": { "simple": "id" }, "First Seen": { "complex": { "filters": [], "root": "firstSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "Last Modified By": { "complex": { "accessor": "lastModifiedBy", "filters": [], "root": "policy", "transformers": [] } }, "Last Modified On": { "complex": { "accessor": "lastModifiedOn", "filters": [], "root": "policy", "transformers": [] } }, "Last Seen": { "complex": { "filters": [], "root": "lastSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Last Update Time": { "complex": { "filters": [], "root": "lastUpdated", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Policy Deleted": { "complex": { "accessor": "deleted", "filters": [], "root": "policy", "transformers": [] } }, "Policy Description": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "Policy ID": { "complex": { "accessor": "policyId", "filters": [], "root": "policy", "transformers": [] } }, "Policy Recommendation": { "complex": { "accessor": "recommendation", "filters": [], "root": "policy", "transformers": [] } }, "Policy Remediable": { "complex": { "accessor": "remediable", "filters": [], "root": "policy", "transformers": [] } }, "Policy Severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "Policy Type": { "complex": { "accessor": "policyType", "filters": [], "root": "policy", "transformers": [] } }, "Prisma Cloud ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "Prisma Cloud Reason": { "complex": { "filters": [], "root": "reason", "transformers": [] } }, "Prisma Cloud Rules": { "complex": { "filters": [], "root": "alertRules", "transformers": [ { "operator": "ConvertKeysToTableFieldFormat" } ] } }, "Prisma Cloud Status": { "complex": { "filters": [], "root": "status", "transformers": [] } }, "Prisma Cloud Dismissal Note": { "complex": { "filters": [], "root": "dismissalNote", "transformers": [] } }, "Prisma Cloud Time": { "complex": { "filters": [], "root": "alertTime", "transformers": [] } }, "RRN": { "simple": "resource.rrn" }, "Region": { "complex": { "accessor": "region", "filters": [], "root": "resource", "transformers": [] } }, "Resource API Name": { "complex": { "accessor": "resourceApiName", "filters": [], "root": "resource", "transformers": [] } }, "Resource Cloud Type": { "complex": { "accessor": "cloudType", "filters": [], "root": "resource", "transformers": [] } }, "Resource ID": { "complex": { "accessor": "id", "filters": [], "root": "resource", "transformers": [] } }, "Resource Name": { "complex": { "accessor": "name", "filters": [], "root": "resource", "transformers": [] } }, "Resource Type": { "complex": { "accessor": "resourceType", "filters": [], "root": "resource", "transformers": [] } }, "Risk Rating": { "complex": { "accessor": "rating", "filters": [], "root": "riskDetail", "transformers": [] } }, "Risk Score": { "complex": { "accessor": "score", "filters": [], "root": "riskDetail", "transformers": [] } }, "SKU Name": { "complex": { "accessor": "data.sku.name", "filters": [], "root": "resource", "transformers": [] } }, "SKU TIER": { "complex": { "accessor": "data.sku.tier", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Assigned By": { "complex": { "accessor": "data.properties.metadata.assignedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created By": { "complex": { "accessor": "data.properties.metadata.createdBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created On": { "complex": { "accessor": "data.properties.metadata.createdOn", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Description": { "complex": { "accessor": "data.properties.description", "filters": [], "root": "resource", "transformers": [] } }, "Subscription ID": { "complex": { "accessor": "data.id", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Name": { "complex": { "accessor": "data.name", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Type": { "complex": { "accessor": "data.type", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated By": { "complex": { "accessor": "data.properties.metadata.updatedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated On": { "complex": { "accessor": "data.properties.metadata.updatedOn", "filters": [], "root": "resource", "transformers": [] } }, "System Default": { "complex": { "accessor": "systemDefault", "filters": [], "root": "policy", "transformers": [] } }, "Vendor Product": { "simple": "Prisma Cloud" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "details": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "name": { "complex": { "accessor": "name", "filters": [], "root": "policy", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "sourceBrand": { "simple": "\"Prisma Cloud\"" } } }, "GCP Compute Engine Misconfiguration": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "complex": { "accessor": "accountId", "filters": [], "root": "resource", "transformers": [] } }, "Account Name": { "complex": { "accessor": "account", "filters": [], "root": "resource", "transformers": [] } }, "Alert ID": { "simple": "id" }, "First Seen": { "complex": { "filters": [], "root": "firstSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "Last Modified By": { "complex": { "accessor": "lastModifiedBy", "filters": [], "root": "policy", "transformers": [] } }, "Last Modified On": { "complex": { "accessor": "lastModifiedOn", "filters": [], "root": "policy", "transformers": [] } }, "Last Seen": { "complex": { "filters": [], "root": "lastSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Last Update Time": { "complex": { "filters": [], "root": "lastUpdated", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Policy Deleted": { "complex": { "accessor": "deleted", "filters": [], "root": "policy", "transformers": [] } }, "Policy Description": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "Policy ID": { "complex": { "accessor": "policyId", "filters": [], "root": "policy", "transformers": [] } }, "Policy Recommendation": { "complex": { "accessor": "recommendation", "filters": [], "root": "policy", "transformers": [] } }, "Policy Remediable": { "complex": { "accessor": "remediable", "filters": [], "root": "policy", "transformers": [] } }, "Policy Severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "Policy Type": { "complex": { "accessor": "policyType", "filters": [], "root": "policy", "transformers": [] } }, "Prisma Cloud ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "Prisma Cloud Reason": { "complex": { "filters": [], "root": "reason", "transformers": [] } }, "Prisma Cloud Rules": { "complex": { "filters": [], "root": "alertRules", "transformers": [ { "operator": "ConvertKeysToTableFieldFormat" } ] } }, "Prisma Cloud Status": { "complex": { "filters": [], "root": "status", "transformers": [] } }, "Prisma Cloud Dismissal Note": { "complex": { "filters": [], "root": "dismissalNote", "transformers": [] } }, "Prisma Cloud Time": { "complex": { "filters": [], "root": "alertTime", "transformers": [] } }, "RRN": { "simple": "resource.rrn" }, "Region": { "complex": { "accessor": "region", "filters": [], "root": "resource", "transformers": [] } }, "Resource API Name": { "complex": { "accessor": "resourceApiName", "filters": [], "root": "resource", "transformers": [] } }, "Resource Cloud Type": { "complex": { "accessor": "cloudType", "filters": [], "root": "resource", "transformers": [] } }, "Resource ID": { "complex": { "accessor": "id", "filters": [], "root": "resource", "transformers": [] } }, "Resource Name": { "complex": { "accessor": "name", "filters": [], "root": "resource", "transformers": [] } }, "Resource Type": { "complex": { "accessor": "resourceType", "filters": [], "root": "resource", "transformers": [] } }, "Risk Rating": { "complex": { "accessor": "rating", "filters": [], "root": "riskDetail", "transformers": [] } }, "Risk Score": { "complex": { "accessor": "score", "filters": [], "root": "riskDetail", "transformers": [] } }, "SKU Name": { "complex": { "accessor": "data.sku.name", "filters": [], "root": "resource", "transformers": [] } }, "SKU TIER": { "complex": { "accessor": "data.sku.tier", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Assigned By": { "complex": { "accessor": "data.properties.metadata.assignedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created By": { "complex": { "accessor": "data.properties.metadata.createdBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created On": { "complex": { "accessor": "data.properties.metadata.createdOn", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Description": { "complex": { "accessor": "data.properties.description", "filters": [], "root": "resource", "transformers": [] } }, "Subscription ID": { "complex": { "accessor": "data.id", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Name": { "complex": { "accessor": "data.name", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Type": { "complex": { "accessor": "data.type", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated By": { "complex": { "accessor": "data.properties.metadata.updatedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated On": { "complex": { "accessor": "data.properties.metadata.updatedOn", "filters": [], "root": "resource", "transformers": [] } }, "System Default": { "complex": { "accessor": "systemDefault", "filters": [], "root": "policy", "transformers": [] } }, "Vendor Product": { "simple": "Prisma Cloud" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "details": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "name": { "complex": { "accessor": "name", "filters": [], "root": "policy", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "sourceBrand": { "simple": "\"Prisma Cloud\"" } } }, "GCP Kubernetes Engine Misconfiguration": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "complex": { "accessor": "accountId", "filters": [], "root": "resource", "transformers": [] } }, "Account Name": { "complex": { "accessor": "accountname", "filters": [], "root": "resource", "transformers": [] } }, "Alert ID": { "simple": "id" }, "First Seen": { "complex": { "filters": [], "root": "firstSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "Last Modified By": { "complex": { "accessor": "lastModifiedBy", "filters": [], "root": "policy", "transformers": [] } }, "Last Modified On": { "complex": { "accessor": "lastModifiedOn", "filters": [], "root": "policy", "transformers": [] } }, "Last Seen": { "complex": { "filters": [], "root": "lastSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Last Update Time": { "complex": { "filters": [], "root": "lastUpdated", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Policy Deleted": { "complex": { "accessor": "deleted", "filters": [], "root": "policy", "transformers": [] } }, "Policy Description": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "Policy ID": { "complex": { "accessor": "policyId", "filters": [], "root": "policy", "transformers": [] } }, "Policy Recommendation": { "complex": { "accessor": "recommendation", "filters": [], "root": "policy", "transformers": [] } }, "Policy Remediable": { "complex": { "accessor": "remediable", "filters": [], "root": "policy", "transformers": [] } }, "Policy Severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "Policy Type": { "complex": { "accessor": "policyType", "filters": [], "root": "policy", "transformers": [] } }, "Prisma Cloud ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "Prisma Cloud Reason": { "complex": { "filters": [], "root": "reason", "transformers": [] } }, "Prisma Cloud Rules": { "complex": { "filters": [], "root": "alertRules", "transformers": [ { "operator": "ConvertKeysToTableFieldFormat" } ] } }, "Prisma Cloud Status": { "complex": { "filters": [], "root": "status", "transformers": [] } }, "Prisma Cloud Dismissal Note": { "complex": { "filters": [], "root": "dismissalNote", "transformers": [] } }, "Prisma Cloud Time": { "complex": { "filters": [], "root": "alertTime", "transformers": [] } }, "RRN": { "simple": "resource.rrn" }, "Region": { "complex": { "accessor": "region", "filters": [], "root": "resource", "transformers": [] } }, "Resource API Name": { "complex": { "accessor": "resourceApiName", "filters": [], "root": "resource", "transformers": [] } }, "Resource Cloud Type": { "complex": { "accessor": "cloudType", "filters": [], "root": "resource", "transformers": [] } }, "Resource ID": { "complex": { "accessor": "id", "filters": [], "root": "resource", "transformers": [] } }, "Resource Name": { "complex": { "accessor": "name", "filters": [], "root": "resource", "transformers": [] } }, "Resource Type": { "complex": { "accessor": "resourceType", "filters": [], "root": "resource", "transformers": [] } }, "Risk Rating": { "complex": { "accessor": "rating", "filters": [], "root": "riskDetail", "transformers": [] } }, "Risk Score": { "complex": { "accessor": "score", "filters": [], "root": "riskDetail", "transformers": [] } }, "SKU Name": { "complex": { "accessor": "data.sku.name", "filters": [], "root": "resource", "transformers": [] } }, "SKU TIER": { "complex": { "accessor": "data.sku.tier", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Assigned By": { "complex": { "accessor": "data.properties.metadata.assignedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created By": { "complex": { "accessor": "data.properties.metadata.createdBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created On": { "complex": { "accessor": "data.properties.metadata.createdOn", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Description": { "complex": { "accessor": "data.properties.description", "filters": [], "root": "resource", "transformers": [] } }, "Subscription ID": { "complex": { "accessor": "data.id", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Name": { "complex": { "accessor": "data.name", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Type": { "complex": { "accessor": "data.type", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated By": { "complex": { "accessor": "data.properties.metadata.updatedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated On": { "complex": { "accessor": "data.properties.metadata.updatedOn", "filters": [], "root": "resource", "transformers": [] } }, "System Default": { "complex": { "accessor": "systemDefault", "filters": [], "root": "policy", "transformers": [] } }, "Vendor Product": { "simple": "Prisma Cloud" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "details": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "name": { "complex": { "accessor": "name", "filters": [], "root": "policy", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "sourceBrand": { "simple": "\"Prisma Cloud\"" } } }, "Prisma Cloud": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "complex": { "accessor": "accountId", "filters": [], "root": "resource", "transformers": [] } }, "Account Name": { "simple": "resource.account" }, "Alert ID": { "simple": "id" }, "First Seen": { "complex": { "filters": [], "root": "firstSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "Last Modified By": { "complex": { "accessor": "lastModifiedBy", "filters": [], "root": "policy", "transformers": [] } }, "Last Modified On": { "complex": { "accessor": "lastModifiedOn", "filters": [], "root": "policy", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Last Seen": { "complex": { "filters": [], "root": "lastSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Last Update Time": { "complex": { "filters": [], "root": "lastUpdated", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Policy Deleted": { "complex": { "accessor": "deleted", "filters": [], "root": "policy", "transformers": [] } }, "Policy Description": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "Policy ID": { "complex": { "accessor": "policyId", "filters": [], "root": "policy", "transformers": [] } }, "Policy Recommendation": { "complex": { "accessor": "recommendation", "filters": [], "root": "policy", "transformers": [] } }, "Policy Remediable": { "complex": { "accessor": "remediable", "filters": [], "root": "policy", "transformers": [] } }, "Policy Severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "Policy Type": { "complex": { "accessor": "policyType", "filters": [], "root": "policy", "transformers": [] } }, "Prisma Cloud ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "Prisma Cloud Reason": { "complex": { "filters": [], "root": "reason", "transformers": [] } }, "Prisma Cloud Rules": { "complex": { "filters": [], "root": "alertRules", "transformers": [ { "operator": "ConvertKeysToTableFieldFormat" } ] } }, "Prisma Cloud Status": { "complex": { "filters": [], "root": "status", "transformers": [] } }, "Prisma Cloud Dismissal Note": { "complex": { "filters": [], "root": "dismissalNote", "transformers": [] } }, "Prisma Cloud Time": { "complex": { "filters": [], "root": "alertTime", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "RRN": { "simple": "resource.rrn" }, "Region": { "complex": { "accessor": "region", "filters": [], "root": "resource", "transformers": [] } }, "Resource API Name": { "complex": { "accessor": "resourceApiName", "filters": [], "root": "resource", "transformers": [] } }, "Resource Cloud Type": { "complex": { "accessor": "cloudType", "filters": [], "root": "resource", "transformers": [] } }, "Resource ID": { "complex": { "accessor": "id", "filters": [], "root": "resource", "transformers": [] } }, "Resource Name": { "complex": { "accessor": "name", "filters": [], "root": "resource", "transformers": [] } }, "Resource Type": { "complex": { "accessor": "resourceType", "filters": [], "root": "resource", "transformers": [] } }, "Risk Rating": { "complex": { "accessor": "rating", "filters": [], "root": "riskDetail", "transformers": [] } }, "Risk Score": { "complex": { "accessor": "score", "filters": [], "root": "riskDetail", "transformers": [] } }, "SKU Name": { "complex": { "accessor": "data.sku.name", "filters": [], "root": "resource", "transformers": [] } }, "SKU TIER": { "complex": { "accessor": "data.sku.tier", "filters": [], "root": "resource", "transformers": [] } }, "Status Reason": { "complex": { "filters": [], "root": "reason", "transformers": [] } }, "Subscription Assigned By": { "complex": { "accessor": "data.properties.metadata.assignedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created By": { "complex": { "accessor": "data.properties.metadata.createdBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created On": { "complex": { "accessor": "data.properties.metadata.createdOn", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Description": { "complex": { "accessor": "data.properties.description", "filters": [], "root": "resource", "transformers": [] } }, "Subscription ID": { "complex": { "accessor": "data.id", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Name": { "complex": { "accessor": "data.name", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Type": { "complex": { "accessor": "data.type", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated By": { "complex": { "accessor": "data.properties.metadata.updatedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated On": { "complex": { "accessor": "data.properties.metadata.updatedOn", "filters": [], "root": "resource", "transformers": [] } }, "System Default": { "complex": { "accessor": "systemDefault", "filters": [], "root": "policy", "transformers": [] } }, "Vendor Product": { "simple": "Prisma Cloud" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "details": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "name": { "complex": { "accessor": "name", "filters": [], "root": "policy", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "sourceBrand": { "simple": "\"Prisma Cloud\"" } } }, "Prisma Cloud - VM Alert Prioritization": { "dontMapEventToLabels": false, "internalMapping": { "Account ID": { "complex": { "accessor": "accountId", "filters": [], "root": "resource", "transformers": [] } }, "Account Name": { "simple": "resource.account" }, "Alert ID": { "simple": "id" }, "First Seen": { "complex": { "filters": [], "root": "firstSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "IncomingMirrorError": { "simple": "in_mirror_error" }, "Last Modified By": { "complex": { "accessor": "lastModifiedBy", "filters": [], "root": "policy", "transformers": [] } }, "Last Modified On": { "complex": { "accessor": "lastModifiedOn", "filters": [], "root": "policy", "transformers": [] } }, "Last Seen": { "complex": { "filters": [], "root": "lastSeen", "transformers": [ { "operator": "TimeStampToDate" } ] } }, "Policy Deleted": { "complex": { "accessor": "deleted", "filters": [], "root": "policy", "transformers": [] } }, "Policy Description": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "Policy ID": { "complex": { "accessor": "policyId", "filters": [], "root": "policy", "transformers": [] } }, "Policy Recommendation": { "complex": { "accessor": "recommendation", "filters": [], "root": "policy", "transformers": [] } }, "Policy Remediable": { "complex": { "accessor": "remediable", "filters": [], "root": "policy", "transformers": [] } }, "Policy Severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "Policy Type": { "complex": { "accessor": "policyType", "filters": [], "root": "policy", "transformers": [] } }, "Prisma Cloud ID": { "complex": { "filters": [], "root": "id", "transformers": [] } }, "Prisma Cloud Reason": { "complex": { "filters": [], "root": "reason", "transformers": [] } }, "Prisma Cloud Rules": { "complex": { "filters": [], "root": "alertRules", "transformers": [ { "operator": "ConvertKeysToTableFieldFormat" } ] } }, "Prisma Cloud Status": { "complex": { "filters": [], "root": "status", "transformers": [] } }, "Prisma Cloud Dismissal Note": { "complex": { "filters": [], "root": "dismissalNote", "transformers": [] } }, "Prisma Cloud Time": { "complex": { "filters": [], "root": "alertTime", "transformers": [] } }, "RRN": { "simple": "resource.rrn" }, "Region": { "complex": { "accessor": "region", "filters": [], "root": "resource", "transformers": [] } }, "Resource API Name": { "complex": { "accessor": "resourceApiName", "filters": [], "root": "resource", "transformers": [] } }, "Resource Cloud Type": { "complex": { "accessor": "cloudType", "filters": [], "root": "resource", "transformers": [] } }, "Resource ID": { "complex": { "accessor": "id", "filters": [], "root": "resource", "transformers": [] } }, "Resource Name": { "complex": { "accessor": "name", "filters": [], "root": "resource", "transformers": [] } }, "Resource Type": { "complex": { "accessor": "resourceType", "filters": [], "root": "resource", "transformers": [] } }, "Risk Rating": { "complex": { "accessor": "rating", "filters": [], "root": "riskDetail", "transformers": [] } }, "Risk Score": { "complex": { "accessor": "score", "filters": [], "root": "riskDetail", "transformers": [] } }, "SKU Name": { "complex": { "accessor": "data.sku.name", "filters": [], "root": "resource", "transformers": [] } }, "SKU TIER": { "complex": { "accessor": "data.sku.tier", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Assigned By": { "complex": { "accessor": "data.properties.metadata.assignedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created By": { "complex": { "accessor": "data.properties.metadata.createdBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Created On": { "complex": { "accessor": "data.properties.metadata.createdOn", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Description": { "complex": { "accessor": "data.properties.description", "filters": [], "root": "resource", "transformers": [] } }, "Subscription ID": { "complex": { "accessor": "data.id", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Name": { "complex": { "accessor": "data.name", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Type": { "complex": { "accessor": "data.type", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated By": { "complex": { "accessor": "data.properties.metadata.updatedBy", "filters": [], "root": "resource", "transformers": [] } }, "Subscription Updated On": { "complex": { "accessor": "data.properties.metadata.updatedOn", "filters": [], "root": "resource", "transformers": [] } }, "System Default": { "complex": { "accessor": "systemDefault", "filters": [], "root": "policy", "transformers": [] } }, "Vendor Product": { "simple": "Prisma Cloud" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, "dbotMirrorId": { "simple": "id" }, "dbotMirrorInstance": { "simple": "mirror_instance" }, "details": { "complex": { "accessor": "description", "filters": [], "root": "policy", "transformers": [] } }, "name": { "complex": { "accessor": "name", "filters": [], "root": "policy", "transformers": [] } }, "severity": { "complex": { "accessor": "severity", "filters": [], "root": "policy", "transformers": [] } }, "sourceBrand": { "simple": "\"Prisma Cloud\"" } } } }, "marketplaces": [ "xsoar" ], "version": -1, "fromVersion": "6.0.0" }