Mapping Enrichment Schema Object

Defines the schema for a mapping enrichment schema.

API Endpoints/resources/v2.1/mapping-enrichment/

Supported MethodsPOST, GET, PATCH, DELETE


The Mapping Enrichment object schema includes the following attributes:

idSystem-generated unique identifier for the enrichment map schema.String
typeEnrichment function type used to create enrichment items.

Must be “mapping” for mapping enrichment endpoints.
activeWhether the mapping rules should be applied to incoming alerts.Boolean
WhenBPQL object query to filter incoming alerts. Only matched alerts will receive a value based on the automatic enrichment item.String
VersionInternal version number of the current schema. This number is incremented automatically each time the schema is updated.Integer
configRules for mapping tag values to event data.

See the Mapping Enrichment Configuration table for details.
created_byThe unique ID associated with the user who created the mapping enrichment rule.String
updated_byThe unique ID associated with the user who last updated the mapping enrichment rule.String
note (optional)A description of the mapping rule purpose or functionality.String

Mapping Enrichment Configuration Parameters

The mapping enrichment configuration schema sets mapping rules for the related mapping tables and includes the following attributes:

nameA system name for the mapping table. This name will appear in the UI.String
fieldsSettings for each field included in the mapping table.

title - column name on the mapping table

type - whether query_tag or result_tag

tag_name - (Optional) the name of the tag in BigPanda

override_existing - (Optional) if a value has been populated for this tag by another map or enrichment rule, whether this value should replace that value

optional - (optional) whether or not the tag must be applied to all incoming alerts. Default is false.
Array of Objects
id_generation_functionMethod for id creation in system.

System field.
case_insensitiveWhether the field names for this configuration take character case into consideration.Boolean


If override_existing is set to false, mapping values will not be added to any alert where the field is already populated, even if the field is populated with a “null.”

Sample Objects:

"active": true,
"when": {},
"name": "mapping_rule",
"case_insensitive": false
"note": ""