{
    "description": "Maps fields from XM Cyber incidents",
    "feed": false,
    "id": "XM Cyber Incident Mapper",
    "fromVersion": "6.0.0",
    "mapping": {
		"XM Cyber Choke Point": {
			"dontMapEventToLabels": false,
			"internalMapping": {
				"Agent ID": {
					"simple": "entityId"
				},
				"XM Cyber avg. complexity level": {
					"complex": {
						"filters": [],
						"root": "level",
						"transformers": []
					}
				},
				"XM Cyber avg. complexity score": {
					"complex": {
						"filters": [],
						"root": "value",
						"transformers": []
					}
				},
				"Device Local IP": {
					"complex": {
						"filters": [
							[
								{
									"left": {
										"isContext": true,
										"value": {
											"simple": "entityBasicData.entityNetworkIdentifierProperties.displayValue"
										}
									},
									"operator": "match",
									"right": {
										"value": {
											"simple": "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
										}
									}
								}
							]
						],
						"root": "entityBasicData.entityNetworkIdentifierProperties.displayValue",
						"transformers": []
					}
				},
				"Device Model": {
					"simple": "entityTypeDisplayName"
				},
				"Device Name": {
					"simple": "displayName"
				},
				"Event ID": {
					"simple": "linkToReport"
				},
				"Event Type": {
					"simple": "type"
				},
				"Log Source": {
					"simple": "linkToReport"
				},
				"OS": {
					"simple": "entitySubType.displayValue"
				},
				"OS Version": {
					"simple": "entityBasicData.entityFlavorProperties.displayValue"
				},
				"Sub Category": {
					"simple": "entityType"
				},
				"name": {
					"simple": "name"
				},
				"occurred": {
					"simple": "create_time"
				},
				"severity": {
					"simple": "severity"
				}
			}
		},
		"XM Cyber Critical Asset": {
			"dontMapEventToLabels": false,
			"internalMapping": {
				"Agent ID": {
					"simple": "entityId"
				},
				"XM Cyber avg. complexity level": {
					"complex": {
						"filters": [],
						"root": "level",
						"transformers": []
					}
				},
				"XM Cyber avg. complexity score": {
					"complex": {
						"filters": [],
						"root": "value",
						"transformers": []
					}
				},
				"Device Local IP": {
					"complex": {
						"filters": [
							[
								{
									"left": {
										"isContext": true,
										"value": {
											"simple": "entityBasicData.entityNetworkIdentifierProperties.displayValue"
										}
									},
									"operator": "match",
									"right": {
										"value": {
											"simple": "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
										}
									}
								}
							]
						],
						"root": "entityBasicData.entityNetworkIdentifierProperties.displayValue",
						"transformers": []
					}
				},
				"Device Model": {
					"simple": "entityTypeDisplayName"
				},
				"Device Name": {
					"simple": "displayName"
				},
				"Event ID": {
					"simple": "linkToReport"
				},
				"Event Type": {
					"simple": "type"
				},
				"Log Source": {
					"simple": "linkToReport"
				},
				"OS": {
					"simple": "entitySubType.displayValue"
				},
				"OS Version": {
					"simple": "entityBasicData.entityFlavorProperties.displayValue"
				},
				"Sub Category": {
					"simple": "entityType"
				},
				"name": {
					"simple": "name"
				},
				"occurred": {
					"simple": "create_time"
				},
				"severity": {
					"simple": "severity"
				}
			}
		},
		"XM Cyber Security Score": {
			"dontMapEventToLabels": false,
			"internalMapping": {
				"XM Cyber current security score": {
					"complex": {
						"filters": [],
						"root": "current_score",
						"transformers": []
					}
				},
				"XM Cyber security score grade": {
					"complex": {
						"filters": [],
						"root": "current_grade",
						"transformers": []
					}
				},
				"XM Cyber security score trend": {
					"complex": {
						"filters": [],
						"root": "trend",
						"transformers": []
					}
				},
				"XM Cyber dashboard": {
					"complex": {
						"filters": [],
						"root": "linkToReport",
						"transformers": []
					}
				},
				"severity": {
					"complex": {
						"filters": [],
						"root": "severity",
						"transformers": []
					}
				}
			}
		},
		"XM Cyber Technique": {
			"dontMapEventToLabels": false,
			"internalMapping": {
				"XM Cyber advices": {
					"complex": {
						"filters": [],
						"root": "advices",
						"transformers": []
					}
				},
				"Choke points": {
					"simple": "chokePoints"
				},
				"Critical assets at risk": {
					"simple": "criticalAssets"
				},
				"XM Cyber critical assets trend": {
					"complex": {
						"filters": [],
						"root": "criticalAssets_trend",
						"transformers": []
					}
				},
				"XM Cyber description": {
					"complex": {
						"filters": [],
						"root": "description",
						"transformers": []
					}
				},
				"Event Type": {
					"simple": "type"
				},
				"XM Cyber MITRE": {
					"complex": {
						"filters": [],
						"root": "mitre",
						"transformers": []
					}
				},
				"Technique Best Practice": {
					"simple": "bestPractice"
				},
				"Technique name": {
					"simple": "displayName"
				},
				"XM Cyber report": {
					"complex": {
						"filters": [],
						"root": "linkToReport",
						"transformers": []
					}
				},
				"name": {
					"simple": "name"
				},
				"occurred": {
					"simple": "create_time"
				},
				"severity": {
					"simple": "severity"
				}
			}
		}
	},
    "name": "XM Cyber Incident Mapper",
    "type": "mapping-incoming",
    "version": -1
}