content/Classifiers/classifier-QRadar.json at master · pvacey/content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
{
	"id": "af6645d1-8209-4c7f-8458-f8edfc77b9e9",
	"version": -1,
	"modified": "2018-04-29T07:46:44.153394526Z",
	"defaultIncidentType": "",
	"mapping": {
		"Access": {
			"internalMapping": {
				"Dest NT Domain": {
					"simple": "",
					"complex": {
						"root": "destination_networks",
						"filters": [],
						"accessor": "",
						"transformers": [
							{
								"operator": "general.join",
								"args": {
									"separator": {
										"value": null,
										"isContext": false
									}
								}
							}
						]
					}
				},
				"Src NT Domain": {
					"simple": "source_network",
					"complex": null
				},
				"Src User": {
					"simple": "offense_source",
					"complex": null
				},
				"details": {
					"simple": "description",
					"complex": null
				},
				"occurred": {
					"simple": "",
					"complex": {
						"root": "start_time",
						"filters": [],
						"accessor": "",
						"transformers": [
							{
								"operator": "number.TimeStampToDate",
								"args": {}
							}
						]
					}
				}
			},
			"dontMapEventToLabels": false
		}
	},
	"custom": true,
	"transformer": {
		"simple": "categories.[0]",
		"complex": null
	},
	"keyTypeMap": {
		"SIM User Authentication": "Access",
		"User Login Failure": "Access"
	},
	"brandName": "QRadar"
}