diff --git a/uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/default.yml b/uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/default.yml index 606317a6..f767249b 100644 --- a/uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/default.yml +++ b/uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/default.yml @@ -47,6 +47,7 @@ field_mapping: c-uri-query: xdm.network.http.url QueryName: xdm.network.dns.dns_question.name Application: xdm.network.application_protocol + sourceNetwork: xdm.source.subnet SourceHostName: xdm.source.host.hostname DestinationHostname: xdm.target.host.hostname Hashes: @@ -128,7 +129,13 @@ field_mapping: url_category: xdm.network.http.url_category EventSeverity: xdm.alert.severity duration: xdm.event.duration + ThreatName: xdm.alert.original_threat_id + AnalyzerName: xdm.observer.type + Classification: xdm.alert.category + ResultCode: xdm.event.outcome_reason + Technique: xdm.alert.mitre_techniques + Action: xdm.event.outcome FileExtension: xdm.target.file.extension Workstation: xdm.source.host.hostname RegistryKey: xdm.target.registry.key - RegistryValue: xdm.target.registry.value \ No newline at end of file + RegistryValue: xdm.target.registry.value diff --git a/uncoder-core/app/translator/mappings/platforms/qradar/default.yml b/uncoder-core/app/translator/mappings/platforms/qradar/default.yml index d0629251..5ff97d09 100644 --- a/uncoder-core/app/translator/mappings/platforms/qradar/default.yml +++ b/uncoder-core/app/translator/mappings/platforms/qradar/default.yml @@ -35,6 +35,7 @@ field_mapping: User: - userName - EventUserName + - Alert Threat Cause Actor Name - Username - Security ID CommandLine: Command @@ -44,6 +45,7 @@ field_mapping: Application: - Application - application + sourceNetwork: sourceNetwork SourceHostName: - HostCount-source - identityHostName @@ -82,6 +84,14 @@ field_mapping: - Source - source duration: duration + ThreatName: + - Threat Name + - Alert Blocked Threat Category + AnalyzerName: Analyzer Name + Classification: Classification + ResultCode: Alert Reason Code + Technique: Technique + Action: Action Workstation: Machine Identifier GroupMembership: Role Name FileName: @@ -91,4 +101,4 @@ field_mapping: - Registry Key - Target Object RegistryValue: RegistryValue - ProcessPath: Process Path \ No newline at end of file + ProcessPath: Process Path