Create a Mapper

Navigate to
Classification & Mapping
.
Click
New
and select the mapper that you want to create.
Incident Mapper (Incoming) - maps all of the fields you are pulling from the integrations to the incident fields in your layouts
Incident Mapper (Outgoing) - maps fields from Cortex XSOAR to the fields in the integration to which you are pushing the data. This is useful for mirroring.
Indicator Mapping (Incoming) - maps all of the indicator fields to their indicator layout.
Under
Get data
, select from where you want to pull the information based on which you will map the incident types.
Pull from instance - select an existing integration instance.
Select schema - when supported by the integration, this will pull all of the fields for the integration from the database. This enables you to see all of the fields for each given event type that the integration supports.
Upload JSON - upload a formatted JSON file which includes the field you want to map.
Under
Incident Type
, start by mapping out the
Default Mapping
. This mapping includes the fields that are common to all of the incident types and will save you time having to define these fields individually in each incident type.
Click the event attribute to which you want to map. You can further manipulate the field using filters and transformers.
You can click
Auto Map
to automatically map fields with common or similar names to fields in Cortex XSOAR. For example, Severity to Importance or Description to Description.
Repeat this process for the other incident types for which this mapping is relevant.
Click
Save
.
Navigate to the
Servers and Services
page.
Select the integration to which you want to apply the mapper.
In the integration settings, under
Mapper
, select the classifier you created and click
Done
.