{
	"id": "crowdstrike-streaming-api-mapper",
    "name": "CrowdStrike Falcon Streaming - Incoming Mapper",
    "type": "mapping-incoming",
    "description": "Maps incoming CrowdStrike Falcon event fields.",
	"version": -1,
	"defaultIncidentType": "",
	"mapping": {
		"Malware": {
			"internalMapping": {
				"Dest": {
					"simple": "event.Hostname",
					"complex": null
				},
				"Dest NT Domain": {
					"simple": "event.LogonDomain",
					"complex": null
				},
				"File Hash": {
					"simple": "event.MD5String",
					"complex": null
				},
				"File Name": {
					"simple": "event.FileName",
					"complex": null
				},
				"File Path": {
					"simple": "event.FilePath",
					"complex": null
				},
				"User": {
					"simple": "event.UserName",
					"complex": null
				},
				"Vendor Product": {
					"simple": "\"CrowdStrike\"",
					"complex": null
				},
				"details": {
					"complex": {
						"accessor": "Description",
						"filters": [],
						"root": "event",
						"transformers": [
							{
								"args": {
									"applyIfEmpty": {
										"isContext": false
									},
									"defaultValue": {
										"isContext": true,
										"value": {
											"simple": "event.Description"
										}
									}
								},
								"operator": "SetIfEmpty"
							}
						]
					}
				},
				"name": {
					"complex": {
						"accessor": "Name",
						"filters": [],
						"root": "event",
						"transformers": [
							{
								"args": {
									"applyIfEmpty": {
										"isContext": false
									},
									"defaultValue": {
										"isContext": true,
										"value": {
											"simple": "event.Name"
										}
									}
								},
								"operator": "SetIfEmpty"
							}
						]
					}
				}
			},
			"dontMapEventToLabels": true
		}
	},
	"fromVersion": "6.0.0"
}