{
    "description": "Maps incoming Trend Vision One alerts.",
    "feed": false,
    "id": "Trend Micro Vision One V3 XDR - Incoming Mapper",
    "mapping": {
        "Trend Micro Vision One XDR Incident": {
            "dontMapEventToLabels": true,
            "internalMapping": {
                "Alert Name": {
                    "complex": {
                        "filters": [],
                        "root": "model",
                        "transformers": []
                    }
                },
                "Description": {
                    "complex": {
                        "filters": [],
                        "root": "description",
                        "transformers": []
                    }
                },
                "Detected User": {
                    "complex": {
                        "accessor": "entity_value",
                        "filters": [],
                        "root": "impact_scope.entities",
                        "transformers": []
                    }
                },
                "Event Type": {
                    "complex": {
                        "accessor": "matched_events",
                        "filters": [],
                        "root": "matched_rules.matched_filters",
                        "transformers": []
                    }
                },
                "Hostnames": {
                    "complex": {
                        "accessor": "name",
                        "filters": [],
                        "root": "impact_scope.entities.entity_value",
                        "transformers": []
                    }
                },
                "MITRE Technique ID": {
                    "complex": {
                        "accessor": "mitre_technique_ids",
                        "filters": [],
                        "root": "matched_rules.matched_filters",
                        "transformers": []
                    }
                },
                "Technique ID": {
                    "complex": {
                        "filters": [
                            [
                                {
                                    "left": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "matched_rules.matched_filters.mitre_technique_ids"
                                        }
                                    },
                                    "operator": "isExists"
                                }
                            ]
                        ],
                        "root": "matched_rules.matched_filters.mitre_technique_ids",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Account Count": {
                    "complex": {
                        "accessor": "account_count",
                        "filters": [],
                        "root": "impact_scope",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Desktop Count": {
                    "complex": {
                        "accessor": "desktop_count",
                        "filters": [],
                        "root": "impact_scope",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Detail": {
                    "complex": {
                        "filters": [],
                        "root": "detail",
                        "transformers": [
                            {
                                "args": {
                                    "headers": {},
                                    "title": {}
                                },
                                "operator": "JsonToTable"
                            }
                        ]
                    }
                },
                "Trend Micro Vision One XDR Email Address Count": {
                    "complex": {
                        "accessor": "email_address_count",
                        "filters": [],
                        "root": "impact_scope",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Impact Scope": {
                    "complex": {
                        "filters": [
                            [
                                {
                                    "left": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "impact_scope.desktop_count"
                                        }
                                    },
                                    "operator": "isExists"
                                }
                            ],
                            [
                                {
                                    "left": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "impact_scope.server_count"
                                        }
                                    },
                                    "operator": "isExists"
                                }
                            ],
                            [
                                {
                                    "left": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "impact_scope.account_count"
                                        }
                                    },
                                    "operator": "isExists"
                                }
                            ],
                            [
                                {
                                    "left": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "impact_scope.email_address_count"
                                        }
                                    },
                                    "operator": "isExists"
                                }
                            ],
                            [
                                {
                                    "left": {
                                        "isContext": true,
                                        "value": {
                                            "simple": "impact_scope.entities"
                                        }
                                    },
                                    "operator": "isExists"
                                }
                            ]
                        ],
                        "root": "impact_scope",
                        "transformers": [
                            {
                                "args": {
                                    "headers": {
                                        "value": {
                                            "simple": "account_count, desktop_count, email_address_count, server_count"
                                        }
                                    },
                                    "is_auto_json_transform": {},
                                    "json_transform_properties": {},
                                    "title": {}
                                },
                                "operator": "JsonToTable"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Account Count"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "account_count"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Desktop Count"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "desktop_count"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Email Address Count"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "email_address_count"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Server Count"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "server_count"
                                        }
                                    }
                                },
                                "operator": "replace"
                            }
                        ]
                    }
                },
                "Trend Micro Vision One XDR Impacted Entities": {
                    "complex": {
                        "accessor": "entities",
                        "filters": [],
                        "root": "impact_scope",
                        "transformers": [
                            {
                                "args": {
                                    "headers": {},
                                    "is_auto_json_transform": {},
                                    "json_transform_properties": {},
                                    "title": {}
                                },
                                "operator": "JsonToTable"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Entity ID"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "entity_id"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Type"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "entity_type"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Value"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "entity_value"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Related Entities"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "related_entities"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Related Indicators"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "related_indicator_ids"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Provenance"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "provenance"
                                        }
                                    }
                                },
                                "operator": "replace"
                            }
                        ]
                    }
                },
                "Trend Micro Vision One XDR Impacted Entities JSON": {
                    "complex": {
                        "accessor": "entities",
                        "filters": [],
                        "root": "impact_scope",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Indicators": {
                    "complex": {
                        "filters": [],
                        "root": "indicators",
                        "transformers": [
                            {
                                "args": {
                                    "headers": {
                                        "value": {
                                            "simple": "id, type, value, related_entities"
                                        }
                                    },
                                    "is_auto_json_transform": {},
                                    "json_transform_properties": {},
                                    "title": {}
                                },
                                "operator": "JsonToTable"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Indicator ID"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "id"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Type"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "type"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Value"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "value"
                                        }
                                    }
                                },
                                "operator": "replace"
                            },
                            {
                                "args": {
                                    "limit": {},
                                    "replaceWith": {
                                        "value": {
                                            "simple": "Related Entities"
                                        }
                                    },
                                    "toReplace": {
                                        "value": {
                                            "simple": "related_entities"
                                        }
                                    }
                                },
                                "operator": "replace"
                            }
                        ]
                    }
                },
                "Trend Micro Vision One XDR Indicators JSON": {
                    "complex": {
                        "filters": [],
                        "root": "indicators",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Investigation Status": {
                    "simple": "investigation_status"
                },
                "Trend Micro Vision One XDR Matched Rules JSON": {
                    "complex": {
                        "filters": [],
                        "root": "matched_rules",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Priority Score": {
                    "complex": {
                        "filters": [],
                        "root": "score",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Server Count": {
                    "complex": {
                        "accessor": "server_count",
                        "filters": [],
                        "root": "impact_scope",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Workbench ID": {
                    "complex": {
                        "filters": [],
                        "root": "id",
                        "transformers": []
                    }
                },
                "Trend Micro Vision One XDR Workbench Link": {
                    "simple": "workbench_link"
                },
                "details": {
                    "complex": {
                        "filters": [],
                        "root": "description",
                        "transformers": []
                    }
                },
                "severity": {
                    "simple": "severity"
                },
                "dbotMirrorDirection": {
                    "complex": {
                        "filters": [],
                        "root": "mirror_direction",
                        "transformers": []
                    }
                },
                "dbotMirrorId": {
                    "complex": {
                        "filters": [],
                        "root": "mirror_id",
                        "transformers": [
                            {
                                "operator": "Stringify"
                            }
                        ]
                    }
                },
                "dbotMirrorInstance": {
                    "complex": {
                        "filters": [],
                        "root": "mirror_instance",
                        "transformers": []
                    }
                }
            }
        }
    },
    "name": "Trend Micro Vision One V3 XDR - Incoming Mapper",
    "type": "mapping-incoming",
    "version": -1,
    "fromVersion": "6.5.0"
}