{
    "description": "Maps incoming Sekoia XDR incidents fields.\n",
    "feed": false,
    "id": "Sekoia XDR - Incoming Mapper",
    "mapping": {
        "Sekoia XDR": {
            "dontMapEventToLabels": true,
            "internalMapping": {
                "Alert Category": {
                    "simple": "alert_type.category"
                },
                "Alert ID": {
                    "simple": "short_id"
                },
                "Alert Name": {
                    "simple": "title"
                },
                "Alert Type ID": {
                    "simple": "alert_type.value"
                },
                "Description": {
                    "simple": "details"
                },
                "External Link": {
                    "simple": "target"
                },
                "Last Seen": {
                    "simple": "last_seen_at"
                },
                "SekoiaXDR Alert Details": {
                    "simple": "details"
                },
                "SekoiaXDR Alert Status": {
                    "simple": "status.name"
                },
                "SekoiaXDR First Seen": {
                    "simple": "first_seen_at"
                },
                "SekoiaXDR Kill Chain": {
                    "complex": {
                        "filters": [],
                        "root": "kill_chain",
                        "transformers": []
                    }
                },
                "SekoiaXDR MirrorOut": {
                    "simple": "mirrorOut"
                },
                "Source Create time": {
                    "complex": {
                        "filters": [],
                        "root": "created_at",
                        "transformers": [
                            {
                                "operator": "TimeStampToDate"
                            }
                        ]
                    }
                },
                "Source IP": {
                    "simple": "source"
                },
                "dbotMirrorDirection": {
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "simple": "mirrored_id"
                },
                "dbotMirrorInstance": {
                    "simple": "mirror_instance"
                },
                "SekoiaXDR Events": {
                    "simple": "events"
                }
            }
        },
        "dbot_classification_incident_type_all": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Alert Category": {
                    "simple": "alert_type.category"
                },
                "Alert ID": {
                    "simple": "short_id"
                },
                "Alert Name": {
                    "simple": "title"
                },
                "Alert Type ID": {
                    "simple": "alert_type.value"
                },
                "Description": {
                    "simple": "details"
                },
                "Last Seen": {
                    "simple": "last_seen_at"
                },
                "SekoiaXDR Alert Details": {
                    "simple": "details"
                },
                "SekoiaXDR Alert Status": {
                    "simple": "status.name"
                },
                "SekoiaXDR First Seen": {
                    "simple": "first_seen_at"
                },
                "SekoiaXDR Kill Chain": {
                    "complex": {
                        "filters": [],
                        "root": "kill_chain",
                        "transformers": []
                    }
                },
                "Source Create time": {
                    "complex": {
                        "filters": [],
                        "root": "created_at",
                        "transformers": [
                            {
                                "operator": "TimeStampToDate"
                            }
                        ]
                    }
                },
                "Source IP": {
                    "simple": "source"
                },
                "dbotMirrorDirection": {
                    "simple": "mirror_direction"
                },
                "dbotMirrorId": {
                    "simple": "mirrored_id"
                },
                "dbotMirrorInstance": {
                    "simple": "mirror_instance"
                }
            }
        }
    },
    "name": "Sekoia XDR - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.10.0"
}