Default Field Mapping in QRadar Content Pack 2.5.7 on XSOAR 6.12

JesusAngel — Tue, 31 Dec 2024 15:54:06 GMT

Hello everyone,

I’m currently using Cortex XSOAR version 6.12 along with the IBM QRadar content pack version 2.5.7 (1602991). The pack includes two mappers for incoming incidents:

QRadar - Generic Incoming Mapper
QRadar - Incoming Mapper

However, I’ve noticed that the default configuration of both mappers only maps a few fields from the incident data. This raises a couple of questions:

Is this limited field mapping the expected behavior for these mappers?
Shouldn’t the majority of fields from QRadar be mapped by default so that playbooks can utilize them without additional manual configuration?

I’d appreciate any insights on whether this is by design or if there’s something missing in my setup. If this is normal, how do you recommend approaching the process of mapping additional fields efficiently?

Thanks in advance for your help!

Re: Default Field Mapping in QRadar Content Pack 2.5.7 on XSOAR 6.12

JStephan — Tue, 07 Jan 2025 13:50:52 GMT

Hi again,

the default mapper (and you need to select the right incident type) has quite a lot of fields (I guess more than 50 or so) mapped from an Offense to an XSOAR incident.

I would believe that these mapped fields are at least the most common ones from regular QRadar offense

topic Default Field Mapping in QRadar Content Pack 2.5.7 on XSOAR 6.12 in Cortex XSOAR Discussions

Default Field Mapping in QRadar Content Pack 2.5.7 on XSOAR 6.12

Re: Default Field Mapping in QRadar Content Pack 2.5.7 on XSOAR 6.12