{ "defaultIncidentType": "ServiceNow Ticket", "description": "Maps incoming ServiceNow incidents fields.", "feed": false, "fromVersion": "6.0.0", "id": "ServiceNow-incoming-mapper", "mapping": { "ServiceNow SIR Incident": { "dontMapEventToLabels": false, "internalMapping": { "Assignment Group": { "complex": null, "simple": "assignment_group" }, "Caller": { "complex": null, "simple": "caller" }, "Destination IP": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "dest_ip" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "dest_ip", "transformers": [] }, "simple": "" }, "Escalation": { "complex": null, "simple": "escalation" }, "Remediation SLA": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "sla_due" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "sla_due", "transformers": [] }, "simple": "" }, "ServiceNow Assigned To": { "complex": null, "simple": "assigned_to" }, "ServiceNow Attack Vector": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "attack_vector" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "attack_vector", "transformers": [] }, "simple": "" }, "ServiceNow Business Impact": { "complex": { "accessor": "", "filters": [], "root": "business_criticality", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - Critical,2 - High,3 - Non-Critical" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Caller": { "complex": null, "simple": "caller" }, "ServiceNow Category": { "complex": null, "simple": "category" }, "ServiceNow Closed By": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "closed_by" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "closed_by", "transformers": [] }, "simple": "" }, "ServiceNow Closed Date": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "closed_at" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "closed_at", "transformers": [ { "args": { "add_utc_timezone": { "isContext": false, "value": null }, "dayfirst": { "isContext": false, "value": { "complex": null, "simple": "false" } }, "fuzzy": { "isContext": false, "value": null }, "yearfirst": { "isContext": false, "value": { "complex": null, "simple": "true" } } }, "operator": "DateStringToISOFormat" }, { "args": { "formatter": { "isContext": false, "value": null } }, "operator": "FormattedDateToEpoch" }, { "args": null, "operator": "TimeStampToDate" } ] }, "simple": "" }, "ServiceNow Due Date": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "due_date" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "due_date", "transformers": [ { "args": { "dayfirst": { "isContext": false, "value": { "complex": null, "simple": "false" } }, "fuzzy": { "isContext": false, "value": null }, "yearfirst": { "isContext": false, "value": null } }, "operator": "DateStringToISOFormat" }, { "args": { "formatter": { "isContext": false, "value": null } }, "operator": "FormattedDateToEpoch" }, { "args": null, "operator": "TimeStampToDate" } ] }, "simple": "" }, "ServiceNow Escalation": { "complex": { "accessor": "", "filters": [], "root": "escalation", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "0,1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "Normal,Moderate,High,Overdue" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Impact": { "complex": { "accessor": "", "filters": [], "root": "impact", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - High,2 - Medium,3 - Low" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Notify": { "complex": { "accessor": "", "filters": [], "root": "notify", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - Do Not Notify,2 - Send Email,3 - Telephone" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Opened Date": { "complex": { "accessor": "", "filters": [], "root": "sys_created_on", "transformers": [ { "args": { "add_utc_timezone": { "isContext": false, "value": null }, "dayfirst": { "isContext": false, "value": { "complex": null, "simple": "false" } }, "fuzzy": { "isContext": false, "value": null }, "yearfirst": { "isContext": false, "value": { "complex": null, "simple": "true" } } }, "operator": "DateStringToISOFormat" } ] }, "simple": "" }, "ServiceNow Priority": { "complex": { "accessor": "", "filters": [], "root": "priority", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3,4,5" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - Critical,2 - High,3 - Moderate,4 - Low,5 - Planning" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Resolution Notes": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "close_notes" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "close_notes", "transformers": [] }, "simple": "" }, "ServiceNow SIR State": { "complex": { "accessor": "", "filters": [], "root": "state", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "3,16,17,18,20,10,100,7" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "Closed,Analysis,Contain,Eradicate,Recover,Draft,Review,Cancelled" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Severity": { "complex": { "accessor": "", "filters": [], "root": "severity", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - High,2 - Medium,3 - Low" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Ticket ID": { "complex": null, "simple": "sys_id" }, "ServiceNow Ticket Number": { "complex": null, "simple": "number" }, "ServiceNow Urgency": { "complex": { "accessor": "", "filters": [], "root": "urgency", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - High,2 - Medium,3 - Low" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "Source IP": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "source_ip" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "source_ip", "transformers": [] }, "simple": "" }, "State": { "complex": null, "simple": "state" }, "Sub Category": { "complex": null, "simple": "subcategory" }, "Ticket Closed Date": { "complex": { "accessor": "", "filters": [ [ { "ignoreCase": false, "left": { "isContext": true, "value": { "complex": null, "simple": "closed_at" } }, "operator": "isNotEmpty", "right": null } ] ], "root": "closed_at", "transformers": [ { "args": { "dayfirst": { "isContext": false, "value": { "complex": null, "simple": "false" } }, "fuzzy": { "isContext": false, "value": null }, "yearfirst": { "isContext": false, "value": null } }, "operator": "DateStringToISOFormat" }, { "args": { "formatter": { "isContext": false, "value": null } }, "operator": "FormattedDateToEpoch" }, { "args": null, "operator": "TimeStampToDate" } ] }, "simple": "" }, "Ticket Number": { "complex": null, "simple": "number" }, "Ticket Opened Date": { "complex": { "accessor": "", "filters": [], "root": "sys_created_on", "transformers": [ { "args": { "dayfirst": { "isContext": false, "value": { "complex": null, "simple": "false" } }, "fuzzy": { "isContext": false, "value": null }, "yearfirst": { "isContext": false, "value": null } }, "operator": "DateStringToISOFormat" }, { "args": { "formatter": { "isContext": false, "value": null } }, "operator": "FormattedDateToEpoch" }, { "args": null, "operator": "TimeStampToDate" } ] }, "simple": "" }, "dbotMirrorDirection": { "complex": null, "simple": "mirror_direction" }, "dbotMirrorId": { "complex": null, "simple": "sys_id" }, "dbotMirrorInstance": { "complex": null, "simple": "mirror_instance" }, "dbotMirrorTags": { "complex": null, "simple": "mirror_tags" }, "details": { "complex": null, "simple": "description" }, "name": { "complex": null, "simple": "short_description" }, "severity": { "complex": { "accessor": "", "filters": [], "root": "risk_score", "transformers": [ { "args": { "by": { "isContext": false, "value": { "complex": null, "simple": "1" } } }, "operator": "subtraction" }, { "args": { "by": { "isContext": false, "value": { "complex": null, "simple": "20" } } }, "operator": "division" }, { "args": {}, "operator": "floor" }, { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "0,1,2,3,4" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "Informational,Low,Medium,High,Critical" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" } } }, "ServiceNow Ticket": { "dontMapEventToLabels": false, "internalMapping": { "Assignment Group": { "complex": null, "simple": "assignment_group" }, "Caller": { "complex": null, "simple": "caller_id" }, "Escalation": { "complex": null, "simple": "escalation" }, "Remediation SLA": { "complex": null, "simple": "sla_due" }, "ServiceNow Assigned To": { "complex": null, "simple": "assigned_to" }, "ServiceNow Category": { "complex": null, "simple": "category" }, "ServiceNow Due Date": { "complex": { "accessor": "", "filters": [], "root": "due_date", "transformers": [ { "args": { "dayfirst": { "isContext": false, "value": { "complex": null, "simple": "false" } }, "fuzzy": { "isContext": false, "value": null }, "yearfirst": { "isContext": false, "value": null } }, "operator": "DateStringToISOFormat" }, { "args": { "formatter": { "isContext": false, "value": null } }, "operator": "FormattedDateToEpoch" }, { "args": null, "operator": "TimeStampToDate" } ] }, "simple": "" }, "ServiceNow Impact": { "complex": { "accessor": "", "filters": [], "root": "impact", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - High,2 - Medium,3 - Low" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Notify": { "complex": { "accessor": "", "filters": [], "root": "notify", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - Do Not Notify,2 - Send Email,3 - Telephone" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow Priority": { "complex": { "accessor": "", "filters": [], "root": "priority", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3,4,5" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - Critical,2 - High,3 - Moderate,4 - Low,5 - Planning" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "ServiceNow State": { "complex": { "filters": [], "root": "state", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "simple": "1,2,3,6,7,8" } }, "mapped_values": { "isContext": false, "value": { "simple": "1 - New,2 - In Progress,3 - On Hold,6 - Resolved,7 - Closed,8 - Canceled" } } }, "operator": "MapValuesTransformer" } ] } }, "ServiceNow Ticket ID": { "complex": null, "simple": "sys_id" }, "ServiceNow Urgency": { "complex": { "accessor": "", "filters": [], "root": "urgency", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,2,3" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "1 - High,2 - Medium,3 - Low" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" }, "State": { "complex": null, "simple": "state" }, "Sub Category": { "complex": null, "simple": "subcategory" }, "Ticket Closed Date": { "complex": { "accessor": "", "filters": [], "root": "closed_at", "transformers": [ { "args": { "dayfirst": { "isContext": false, "value": { "complex": null, "simple": "false" } }, "fuzzy": { "isContext": false, "value": null }, "yearfirst": { "isContext": false, "value": null } }, "operator": "DateStringToISOFormat" }, { "args": { "formatter": { "isContext": false, "value": null } }, "operator": "FormattedDateToEpoch" }, { "args": null, "operator": "TimeStampToDate" } ] }, "simple": "" }, "Ticket Number": { "complex": null, "simple": "number" }, "Ticket Opened Date": { "complex": { "accessor": "", "filters": [], "root": "opened_at", "transformers": [ { "args": { "dayfirst": { "isContext": false, "value": { "complex": null, "simple": "false" } }, "fuzzy": { "isContext": false, "value": null }, "yearfirst": { "isContext": false, "value": null } }, "operator": "DateStringToISOFormat" }, { "args": { "formatter": { "isContext": false, "value": null } }, "operator": "FormattedDateToEpoch" }, { "args": null, "operator": "TimeStampToDate" } ] }, "simple": "" }, "dbotMirrorDirection": { "complex": null, "simple": "mirror_direction" }, "dbotMirrorId": { "complex": null, "simple": "sys_id" }, "dbotMirrorInstance": { "complex": null, "simple": "mirror_instance" }, "dbotMirrorTags": { "complex": null, "simple": "mirror_tags" }, "details": { "complex": null, "simple": "description" }, "name": { "complex": null, "simple": "short_description" }, "severity": { "complex": { "accessor": "", "filters": [], "root": "severity", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,1 - High,2,2 - Medium,3,3 - Low" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "3,3,2,2,1,1" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" } } }, "dbot_classification_incident_type_all": { "dontMapEventToLabels": false, "internalMapping": { "severity": { "complex": { "accessor": "", "filters": [], "root": "severity", "transformers": [ { "args": { "input_values": { "isContext": false, "value": { "complex": null, "simple": "1,1 - High,2,2 - Medium,3,3 - Low" } }, "mapped_values": { "isContext": false, "value": { "complex": null, "simple": "3,3,2,2,1,1" } } }, "operator": "MapValuesTransformer" } ] }, "simple": "" } } } }, "name": "ServiceNow - Incoming Mapper", "type": "mapping-incoming", "version": -1, "supportedModules": [ "agentix", "xsiam" ] }