{
    "description": "",
    "feed": false,
    "id": "Skyhigh Security Incoming Mapper",
    "mapping": {
        "Skyhigh Security Threat": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Skyhigh Security Activity Names": {
                    "simple": "activityNames"
                },
                "Skyhigh Security Actor ID": {
                    "simple": "actorId"
                },
                "Skyhigh Security Actor ID Type": {
                    "simple": "actorIdType"
                },
                "Alert Category": {
                    "simple": "incidentGroup"
                },
                "Cloud Service": {
                    "simple": "serviceNames"
                },
                "Last Update Time": {
                    "simple": "timeModified"
                },
                "Policy Actions": {
                    "simple": "responses"
                },
                "Risk Score": {
                    "simple": "incidentRiskScore"
                },
                "Skyhigh Security Significantly Updated At": {
                    "simple": "significantlyUpdatedAt"
                },
                "Source Status": {
                    "simple": "status"
                },
                "Start Time": {
                    "simple": "timeCreated"
                },
                "severity": {
                    "simple": "incidentRiskSeverity"
                },
                "Alert Action": {
                    "simple": "information.remediationResponse"
                },
                "Skyhigh Security Anomaly Count": {
                    "simple": "information.anomalyCount"
                },
                "Skyhigh Security Anomaly IDs": {
                    "simple": "information.anomalyIds"
                },
                "Device External IP": {
                    "simple": "information.device.ip"
                },
                "Skyhigh Security Device Type": {
                    "simple": "information.device.device_type"
                },
                "Event ID": {
                    "simple": "information.eventId"
                },
                "Skyhigh Security Is Tokenized": {
                    "simple": "information.isTokenized"
                },
                "OS": {
                    "simple": "information.device.os.platform"
                },
                "Skyhigh Security Resolution Action": {
                    "simple": "information.resolutionAction"
                },
                "User Agent": {
                    "simple": "information.device.application.user_agent"
                },
                "Skyhigh Security User Attributes": {
                    "simple": "information.userAttributes"
                }
            }
        },
        "Skyhigh Security Alert": {
            "dontMapEventToLabels": false,
            "internalMapping": {
                "Account ID": {
                    "simple": "information.accountId"
                },
                "Skyhigh Security Activity Count": {
                    "simple": "information.activityCount"
                },
                "Skyhigh Security Activity Names": {
                    "simple": "activityNames"
                },
                "Skyhigh Security Actor ID": {
                    "simple": "actorId"
                },
                "Skyhigh Security Actor ID Type": {
                    "simple": "actorIdType"
                },
                "Alert Action": {
                    "simple": "information.remediationResponse"
                },
                "Alert Category": {
                    "simple": "incidentGroup"
                },
                "Skyhigh Security Anomaly Category": {
                    "simple": "information.anomalyCategory"
                },
                "Skyhigh Security Anomaly Cause": {
                    "simple": "information.anomalyCause"
                },
                "Skyhigh Security Anomaly Value": {
                    "simple": "information.contentItemValue"
                },
                "Categories": {
                    "simple": "information.threatCategory"
                },
                "City": {
                    "simple": "information.cities"
                },
                "Cloud Service": {
                    "simple": "serviceNames"
                },
                "Skyhigh Security Content Item Hierarchy": {
                    "simple": "information.Content Item Created On"
                },
                "Skyhigh Security Content Item ID": {
                    "simple": "information.contentItemId"
                },
                "Skyhigh Security Content Item Name": {
                    "simple": "information.contentItemName"
                },
                "Skyhigh Security Content Item Parent": {
                    "simple": "information.contentItemParent"
                },
                "Skyhigh Security Content Item Size": {
                    "simple": "information.contentItemSize"
                },
                "Skyhigh Security Content Item Type": {
                    "simple": "information.contentItemType"
                },
                "Country": {
                    "simple": "information.countries"
                },
                "Skyhigh Security Destination Hostname": {
                    "simple": "information.destinationHost"
                },
                "Device External IP": {
                    "simple": "information.device.ip"
                },
                "Skyhigh Security Device Type": {
                    "simple": "information.device.device_type"
                },
                "Domain Name": {
                    "simple": "information.recipientDomains"
                },
                "Event Action": {
                    "simple": "information.userAction"
                },
                "Event ID": {
                    "simple": "information.eventId"
                },
                "File Hash": {
                    "simple": "information.Checksums"
                },
                "Skyhigh Security Is Part Of Threat": {
                    "simple": "information.isPartOfThreat"
                },
                "Skyhigh Security Is Tokenized": {
                    "simple": "information.isTokenized"
                },
                "Last Update Time": {
                    "simple": "timeModified"
                },
                "Skyhigh Security Malware Confidence": {
                    "simple": "information.malwareConfidence"
                },
                "Malware Family": {
                    "simple": "information.malwareCategory"
                },
                "Malware Name": {
                    "simple": "information.malwareName"
                },
                "Org Unit": {
                    "simple": "information.sourceIpOrgs"
                },
                "OS": {
                    "simple": "information.device.os.platform"
                },
                "Policy Actions": {
                    "simple": "responses"
                },
                "Policy Description": {
                    "simple": "information.policyName"
                },
                "Policy ID": {
                    "simple": "information.policyId"
                },
                "Region": {
                    "simple": "information.region"
                },
                "Skyhigh Security Resolution Action": {
                    "simple": "information.resolutionAction"
                },
                "Risk Score": {
                    "simple": "incidentRiskScore"
                },
                "Rule Name": {
                    "simple": "information.primaryRuleGroup"
                },
                "Skyhigh Security Scan Name": {
                    "simple": "information.scanName"
                },
                "Skyhigh Security Scan Run Date": {
                    "simple": "information.scanRunDate"
                },
                "Skyhigh Security Significantly Updated At": {
                    "simple": "significantlyUpdatedAt"
                },
                "Source IPs": {
                    "simple": "information.sourceIps"
                },
                "Source Status": {
                    "simple": "status"
                },
                "Start Time": {
                    "simple": "timeCreated"
                },
                "Skyhigh Security Total Match Count": {
                    "simple": "information.totalMatchCount"
                },
                "Skyhigh Security URLs": {
                    "simple": "information.destinationUrl"
                },
                "Skyhigh Security Unique Activity Names": {
                    "simple": "information.uniqueActivityNames"
                },
                "User Agent": {
                    "simple": "information.device.application.user_agent"
                },
                "Skyhigh Security User Attributes": {
                    "simple": "information.userAttributes"
                },
                "Skyhigh Security content Item Created On": {
                    "simple": "information.contentItemCreatedOn"
                },
                "severity": {
                    "simple": "incidentRiskSeverity"
                }
            }
        }
    },
    "name": "Skyhigh Security Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.5.0"
}