Create an incident classifier - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Go to Settings & Info → Settings → Object Setup → Incidents → Classification & Mapping.

Do one of the following:

1. To create a new classifier, select New → Incident Classifier.

2. To edit an existing classifier open the classifier.

   If the classifier is installed from a content pack, you need to duplicate and then open it.

Enter a name for the classifier so it can be easily identified.

Under Get data, select from where you want to pull the event data. You will classify the incident types based on this information.

Under Select Instance, select the integration instance from where you want to pull data.

In the Data fetched from [name of integration instance) section, you will see the raw alert data pulled in from the integration instance. In this example, after configuring the Sample Incident Generator instance, we have pulled in the following data:

To route the alert information to an incident type, select the classification key,

1. In the Data fetched section, click the key you want to map. For example, type.

   Tip

   Select a key that is common to across all the samples. If a key is selected that will change across all alerts such as SourceIP there could be many values.

   In the Unmapped Values section, the selected key returns any unmapped classifier values. For example, type returns Malware, Unclassified, and Phishing.

   

2. Drag and drop the unmapped classifier values onto the Incident Types section.

   For example, you can see the Malware and Phishing values have been mapped to the relevant incident type.

   

3. In the Direct Unclassified events to field, select the incident type for unclassified events.

   If you don't choose a default incident type, the classifier uses the default incident type, which is set to the Unclassified incident type. To view the default incident type, go to the Incidents page and add the Default column. You can set a different default incident type as required.

4. (Optional) If there are events that haven't been pulled from the samples you can manually add them to the Incident Types section, by clicking the edit button in the Incident Type field. For example, if you know that the source has a file blocked incident type, click the edit button on the relevant field and type file blocked.

Save the classifier.

(Optional) Create a mapper, if required.

Go to Settings & Info → Settings → Integrations → Instances.

1. Select the integration from which you want to apply the classifier.

2. In the integration settings, under Classifier, select the classifier you created and click Done.

   For some instance integrations, you need to click Fetches incidents to add a classifier and mapper.