Mapping Enrichment Schema Object

Defines the schema for a mapping enrichment schema.

API Endpoints/resources/v2.1/mapping-enrichment/

Supported MethodsPOST, GET, PATCH, DELETE


The Mapping Enrichment object schema includes the following attributes:

idSystem-generated unique identifier for the enrichment map schema.String1234a53b6789c12d3efg45h
typeEnrichment function type used to create enrichment items.

Must be “mapping” for mapping enrichment endpoints.
activeWhether the mapping rules should be applied to incoming alerts.Booleantrue
WhenBPQL query to filter incoming alerts. Only matched alerts will receive a value based on the automatic enrichment item.{ "IN": \[ "source_system", [ { "type": "regex", "value": "*" } ] ] }
VersionInternal version number of the current schema. This number is incremented automatically each time the schema is updated.Integer1
configRules for mapping tag values to event data.

See the Mapping Enrichment Configuration table for details.
Object{ "name": "example", "fields": [ { "title": "application", "type": "query_tag", "tag_name": "yes", "override_existing": true, "optional": false }, { "title": "walla", "type": "result_tag", "tag_name": "walla", "override_existing": false }, { "title": "very_cool", "type": "result_tag", "tag_name": "very_cool", "override_existing": false } ], "id_generation_function": "use_md5", "case_insensitive": false }
created_byThe unique ID associated with the user who created the mapping enrichment rule.String58d77efa5eafe459163f4555
updated_byThe unique ID associated with the user who last updated the mapping enrichment rule.String58d77efa5eafe459163f4555
note (optional)A description of the mapping rule purpose or functionality.StringCMDB table


Current runbook table

Mapping Enrichment Configuration Parameters

The mapping enrichment configuration schema sets mapping rules for the related mapping tables and includes the following attributes:

nameA system name for the mapping table. This name will appear in the UI.String"example"
fieldsSettings for each field included in the mapping table.

title - column name on the mapping table

type - whether query_tag or result_tag

tag_name - (Optional) the name of the tag in BigPanda

override_existing - (Optional) if a value has been populated for this tag by another map or enrichment rule, whether this value should replace that value

optional - (optional) whether or not the tag must be applied to all incoming alerts. Default is false.
Array of Objects[ { "title": "application", "type": "query_tag", "tag_name": "yes", "override_existing": true, "optional": false }, { "title": "walla", "type": "result_tag", "tag_name": "walla", "override_existing": false } ]
id_generation_functionMethod for id creation in system.

System field.
case_insensitiveWhether the field names for this configuration take character case into consideration.Booleanfalse


If override_existing is set to false, mapping values will not be added to any alert where the field is already populated, even if the field is populated with a “null.”

"active": true,
"when": {},
"name": "mapping_rule",
"case_insensitive": false
"note": ""