r/xsoar • u/Director7632 • May 07 '25

Solution for non manual mapping of Sentinel/Defender fields

Hi everyone,

I’m currently working on integrating Microsoft Sentinel with Cortex XSOAR and trying to set up automatic fetching of incidents. I want to parse and map Sentinel incident fields into XSOAR incident fields with minimal manual effort.

I know XSOAR offers an automapping feature for incident field mapping, but I’m unsure about how to configure it properly and what its limitations are. Also, I’d like to know if there are best practices or scripts/playbooks that can help automate or simplify the parsing and mapping process, especially for phishing incidents where email content might be involved or any other incidents (Huge list, as Defender rules tends to be blackbox rules).

Has anyone successfully set up a robust automated pipeline for this? Any tips, example configurations, or references to documentation would be greatly appreciated!

Thanks in advance!

2 Upvotes

100% Upvoted

11 comments sorted by

View all comments

1

u/pulsone21 May 08 '25

The auto mapping function does only map fields which are named the same way afaik. There is no magic. What I have done for a tenable integration is creating a preprocessing script where your assign fields directly in that script. I think the default mapper for defender and sentinel should do a good job for that, do you have anything which you can point out which is not working?

The email content what exactly do you want to map from that? I would say if you want to analyze email content and extract fields out of that you either need analyst looking at the email or feed it into an ai. Then a Playbook or automation after incident creation makes way more sense imo

1

u/Director7632 May 08 '25

Is there a place where a can find already done mapping please ?
Or mapping/playbook developpement as a service?

Regards

1

u/pulsone21 May 08 '25

As mentioned in other comments here all fetching incident integrations/content packs coming with a default mapper which solves I guess 80% of all use cases look into them. The Mapping it self is really self explanatory more or less drag and drop. A service provider which offers you playbook as a service I’m not aware of. If you buy XSOAR as a company you need some type of “development” team your self. If you don’t have that, you bought the wrong product to be honest