Configure mapping and assign visual families

The Event Configuration feature lets you assign visual families to events, providing a graphic visualization of their relationships with other actions. This process ensures events are correctly categorized and contain accurate and complete information.

Event configuration contains the following capabilities:

• Visualization: Assign a family to an event. This family acts as a visual map of relationships and entities, giving you the best graphic explanation of what happened. The assigned family appears on the Explore Cases screen.
• Mapping: Edit or add specific field information to correct errors or fill in missing data.

To access the Event Configuration page, do one of the following:

• Select a case from the case queue, go to the alert Events tab, and click settings Configure.
• In Settings > Ontology > Ontology Status, click settings Configure.

Assign a model family

The model family provides a graphic visualization of the relationship between all the events and actions that take place.

The Visualization page is where you assign the event, product, or source to a specific family. This visual family appears on the Explore Cases page.

You can assign a model family at three levels:

• Source Level: The top level. A family assigned here is inherited by all products and events within that source.
• Product Level: The second level. A family assigned here is inherited by all events within that product.
• Event Level: The ground level.

The model family is inherited from the parent. If you assign a family at source level, the product and event inherit the model family from the source level. You can edit the mapped fields at each level to override the parent settings.

Google Security Operations provides 24 standard model families, and you can create more as needed. For more information, see Visual families.

To assign a model family, follow these steps:

1. On the Events Configuration page, click Visualization.
2. Select the model family that most resembles the relationship between events and actions that occur in this situation.
3. In the Confirmation dialog, click Yes to confirm the assignment.

Manage an event's specific field

The Mapping page is where you manage an event's specific field information. It displays the fields that belong to the assigned model family.

For example, if an event is ingeested and you can see missing or incorrect information, do the following:

1. On the Alerts Events tab, click settings Configure and verify that it's assigned to the correct visual family.
2. Go to the Mapping page to edit or add specific field information.

You can perform various actions on these fields:

1. Click more_vert More at the end of each row.
2. Click edit Edit FIeld.
3. In the Map Target Field dialog, enter the name of the event field to extract and click Save.

Editable fields

Double-click the entity to edit the following fields:

You can extract data from one source field and map it to different target fields. For example, if a source field has both a hostname and an IP address, you can separate them using regular expressions.

Show results after mapping

To view the values after the mapping process, follow these steps:

• Click more_vert More > Show Result.

Add enrichment data

Various SIEMs include enrichment data as part of the initial ingestion process. To add enrichment data, follow these steps:

1. Select more_vert More > database_upload Add Enrichment.
2. Choose which enrichment values you want to add to the entity.
3. Click Save. The next time this entity is ingested into the platform as part of the alert, click View Details and this enrichment field will appear under the Raw Enrichment heading in the side drawer.