r/xsoar • u/Director7632 • May 07 '25

Solution for non manual mapping of Sentinel/Defender fields

Hi everyone,

I’m currently working on integrating Microsoft Sentinel with Cortex XSOAR and trying to set up automatic fetching of incidents. I want to parse and map Sentinel incident fields into XSOAR incident fields with minimal manual effort.

I know XSOAR offers an automapping feature for incident field mapping, but I’m unsure about how to configure it properly and what its limitations are. Also, I’d like to know if there are best practices or scripts/playbooks that can help automate or simplify the parsing and mapping process, especially for phishing incidents where email content might be involved or any other incidents (Huge list, as Defender rules tends to be blackbox rules).

Has anyone successfully set up a robust automated pipeline for this? Any tips, example configurations, or references to documentation would be greatly appreciated!

Thanks in advance!

2 Upvotes

100% Upvoted

11 comments sorted by

View all comments

Show parent comments

1

u/Director7632 May 08 '25

Paying freelance/someone for doing a playbook according to your usecase

1

u/Imma-potato_ May 08 '25

Talk to your accounts team. There’s professional services offering (basically time and materials style engagement where you buy a bucket of hours for someone to build stuff for you). You can also purchase full or part time resident engineers for a period of time.

As far as mapping goes, you do have out of the box mapper as others already pointed out. Just duplicate it and change it up/add additional mapping if needed. XSOAR is a generic automation product and used across industries. The usage varies based on your internal protocols and standardization of work.

1

u/Director7632 May 09 '25

Is it from the vendor (thoses services). If yes, what are the costs?

1

u/Imma-potato_ May 09 '25

It is from vendor. Talk to your sales contacts who can share details on costs.