Mappers

A mapper is a Hamelin query that reads a parser's table and normalizes its fields into ECS.

A mapper lives under an integration and reads one or more parser tables. Every mapper in an integration becomes a named branch of the integration's composite view, which produces the normalized events_ecs.<integration> dataset that detections read. A mapper's id is prefixed MPR_.

Inputs

Field	Type	Required	Description
name	string	Required	Mapper name within the integration. Becomes the branch identifier in the integration's composite view, lowercased and sanitized. Must start with a letter, end with a letter, number, underscore, or closing parenthesis, and contain only letters, numbers, spaces, underscores, hyphens, dots, or parentheses.
query	string	Required	The Hamelin query that reads parser tables and produces ECS output.
deploy	boolean	Optional	Whether the mapper is live in the integration's composite view. true includes its normalized output in the events_ecs.<integration> dataset. false leaves it as saved content. Default false.
parserIds	array<string>	Optional	The parsers whose tables this mapper reads, each prefixed PRS_.

Outputs

Field	Type	Description
deploymentStatus	enum	Deployment state of the mapper: UNDEPLOYED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, DEPLOYED, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, FAILED, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.

Plus the common resource fields.

Related

• Integrations, the resource a mapper lives under.
• Parsers, which land the table a mapper reads.
• Views, the composite view a mapper's output branches into.
• ECS field reference, the schema a mapper targets.
• Event normalization, why Perpetual maps every source to a shared schema.
• Map a source to ECS, how to author, validate, and deploy a mapper.