Default Field Mapping in QRadar Content Pack 2.5.7 on XSOAR 6.12

[JesusAngel]

Hello everyone,

I’m currently using Cortex XSOAR version 6.12 along with the IBM QRadar content pack version 2.5.7 (1602991). The pack includes two mappers for incoming incidents:

• QRadar - Generic Incoming Mapper
• QRadar - Incoming Mapper

However, I’ve noticed that the default configuration of both mappers only maps a few fields from the incident data. This raises a couple of questions:

1. Is this limited field mapping the expected behavior for these mappers?
2. Shouldn’t the majority of fields from QRadar be mapped by default so that playbooks can utilize them without additional manual configuration?

I’d appreciate any insights on whether this is by design or if there’s something missing in my setup. If this is normal, how do you recommend approaching the process of mapping additional fields efficiently?

Thanks in advance for your help!