> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md). # Classification and mapping The classification and mapping feature enables you to take events and event information ingested from integrations, classify the event as an incident type, and map event information to incident fields in Cortex XSOAR. {% hint style="info" %} ### Note * Classifiers and mappers can be created with or without association to a specific integration instance and can be assigned to multiple instances. An integration can only have a classifier or only a mapper. * When creating a classifier and mapper, you can contribute them to the Marketplace. {% endhint %} For more information about classification and mapping, see the following video: [Classification and Mapping](https://www.youtube.com/watch?v=TW-q2wmchZk). #### Classification Classification determines the type of incident that is created for events ingested from a specific integration. For example, Cortex XSOAR might generate alerts from Cortex Traps which you would classify either as a dedicated Traps, Authentication, or Malware incident type. By classifying the events as different incident types, you can process them with different playbooks in the incident type, which is suited to their respective requirements. You have the following options for classification: * You can hard code every alert fetched from the integration to a specific incident type, by selecting the incident type in the integration instance settings. This is useful where you want all alerts classified to a single type, such as phishing and have the same playbook execute on the same incident. * Most integrations produce a variety of alerts that you may want to send to separate incident types, which may use different playbook/response processes. Create an incident classifier to route alerts from the integration to incident types in Cortex XSOAR. After you create a classifier, add the classifier to an integration. For more information, see [Create an incident classifier](/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md). {% hint style="info" %} ### Note To hard code an incident type or select a classifier in an integration instance, you may need to select **Fetches incidents** in the integration instance settings. {% endhint %} Some content packs include classifiers, which have incident types already classified. For example, the **Cortex XDR Incident Handler - Classifier** classifies events such as FirstSSOAccess and RDPBruteForce as Cortex XDR Incident types in Cortex XSOAR. #### Mapping Mapping enables you to map important information from incoming alerts into incident fields for use in playbooks and in layouts, so analysts can view the information when investigating an incident. Some content packs include mappers, which have fields already mapped. For example, the **XDR - Incoming Mapper** includes fields such as **Hostnames**, **LastMirroedInTime**, and **Occurred** are already mapped. To create a mapper, see [Create an incident mapper](/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-mapper.md). Mappers enable you to do the following: * When building playbooks, incidents are much easier to use and allow you to take different actions based on those fields within a playbook. * Most field types become searchable. For example, if you map the source username to a field, you can query that field with other incidents with the same source username. It is easier to correlate, deduplicate, query, and report. * Easily add fields to layouts for display and review by the analyst. * Perform indicator extraction based on the incident type and its fields. Extract specific indicators from specific fields. * Mirror content in Cortex XSOAR with third-party integrations. This enables you to make changes to an incident in Cortex XSOAR and have that change be reflected in the case managed by the integration. For example, if you are using a case management system such as JIRA or Salesforce, you can close an incident in Cortex XSOAR and have that reflected automatically.

Note

The integration must support pulling the integration schema for mirroring to work.

#### Using JSON files When creating a classifier or mapper you can use the following: * Integration instance: The instance needs to be configured and enabled. * Select a schema: When supported by the integration, this pulls all of the integration fields from the database. * Upload a JSON file: If you can't pull samples or the samples do not retrieve sufficient data, upload a formatted JSON file. The JSON file needs to be in an array of dictionaries, with each alert in its own dictionary. For example: ```programlisting [ { "type": "url allowed", "EventID": "5106", "urlCategory": "PHISH", "sourceIP": "10.8.8.181", "occurred": "2024-05-22T08:16:26Z", "sourceUser": "james.bond@xsoar.local", "url": "https://notthedomainyouarelookingfor.com/login.php", "userAgent": "Mozilla/5.0(WindowsNT6.1;WOW64;rv:27.0)Gecko/20100101Firefox/27.0" }, { "type": "url blocked", "EventID": "7893", "urlCategory": "MALWARE", "sourceIP": "10.8.8.127", "occurred": "2024-05-22T08:16:26Z", "sourceUser": "eve.moneypenny@xsoar.local", "url": "https://notthedomainyouarelookingfor.com/login.zip", "userAgent": "Mozilla/5.0(WindowsNT6.1;WOW64;rv:27.0)Gecko/20100101Firefox/27.0" } ] ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.