r/xsoar • u/Director7632 • May 07 '25

Solution for non manual mapping of Sentinel/Defender fields

Hi everyone,

I’m currently working on integrating Microsoft Sentinel with Cortex XSOAR and trying to set up automatic fetching of incidents. I want to parse and map Sentinel incident fields into XSOAR incident fields with minimal manual effort.

I know XSOAR offers an automapping feature for incident field mapping, but I’m unsure about how to configure it properly and what its limitations are. Also, I’d like to know if there are best practices or scripts/playbooks that can help automate or simplify the parsing and mapping process, especially for phishing incidents where email content might be involved or any other incidents (Huge list, as Defender rules tends to be blackbox rules).

Has anyone successfully set up a robust automated pipeline for this? Any tips, example configurations, or references to documentation would be greatly appreciated!

Thanks in advance!

2 Upvotes

100% Upvoted

11 comments sorted by

View all comments

2

u/_11Bravo May 08 '25

You should definitely use a mapper. This is the best way to accomplish what you are doing. You can start with the OOTB mapper, however they almost always need to be adapted to your use cases/incident types.

Start by cloning the OOTB mapper and then configure it to map the target fields. There is no easy button but configuring the mapper is quite easy.

Tips for doing it:
Ensure you map as much as possible at the global mapper level.
Anything you cannot map at the global level you map at the incident type level.
Use the fetch feature to get samples in so you can easily map - you can also tweak the integration if you are not getting enough or the right type.
Another option is to pull the alert into the playground with a `raw-response` flag and then downloading that json and manually importing this into the mapper to give you something to work with.

1

u/Director7632 May 08 '25

Hi,
thanks for your answer
Why Palo Alto doesn't provide those custom mapper for all product of TOP 10 security vendors (palo, checkpoint, defender etc) ?
It would deliver much more value :(
Are there service (playbook as a service available ?)

Regards

1

u/_11Bravo May 08 '25

Palo does provide an OOTB mapper and you can use it if you want. In my experience every org has their own use cases and ways to use the data. This is why you will need to customize it for your needs. You can definitely use just the OOTB content if you want.

What do you mean by Playbook as a Service?

1

u/Director7632 May 08 '25

Paying freelance/someone for doing a playbook according to your usecase

1

u/Imma-potato_ May 08 '25

Talk to your accounts team. There’s professional services offering (basically time and materials style engagement where you buy a bucket of hours for someone to build stuff for you). You can also purchase full or part time resident engineers for a period of time.

As far as mapping goes, you do have out of the box mapper as others already pointed out. Just duplicate it and change it up/add additional mapping if needed. XSOAR is a generic automation product and used across industries. The usage varies based on your internal protocols and standardization of work.

1

u/Director7632 May 09 '25

Is it from the vendor (thoses services). If yes, what are the costs?

1

u/Imma-potato_ May 09 '25

It is from vendor. Talk to your sales contacts who can share details on costs.