Configure Custom Case and Incident Management Data Mappings

Because TEDS (Turbine Extendable Data Schema) relies on the most common attributes for a given object type, such as alerts, there are vendor-specific fields that are not mapped in TEDS objects. In order to map these fields to Case and Incident Management (CIM) records, you will need to use the SOC - Extract Raw Alert Fields to CIM playbook to extract values from the raw alert object included in the TEDS object and record, and write those values to fields you have created in the CIM application.

There are two approaches to mapping custom fields:

Prerequisites

Before configuring custom field mappings:

Have access to the SOC - Extract Raw Alert Fields to CIM playbook

Understand the structure of your raw alert data

Have created custom fields in the CIM application for the fields you want to map

Know the exact field key names in your CIM application (they must match exactly)

Option 1 - Discrete Mappings (Native Transformations)

This approach uses individual transformation blocks for each field you want to extract. Use this method when you have a small number of fields or need different transformation logic for each field.

Step 1: Create Custom Fields in CIM Application

Navigate to Applications in the Swimlane platform.

Open the Case and Incident Management (CIM) application.

For each vendor-specific field you want to add:

Create a new field of the appropriate type (text, number, date, etc.)

Important: Note the exact field key name - it must match exactly what you'll use in the mapping

Configure any field properties (required, default values, etc.)

Step 2: Edit the Extract Raw Alert Fields to CIM Playbook

Navigate to Orchestration → Playbooks.

Locate and open the SOC - Extract Raw Alert Fields to CIM playbook.

Review the playbook structure to understand the workflow.

Step 3: Configure Field Extraction

For each vendor-specific field you wish to extract to CIM:

3.1: Create a Transformation Block

Locate the Extract Fields action in the playbook.

Click Edit on the Extract Fields action.

Create a new Transformation Block:

Click "Add Transformation" or "New Block"

Select the transformation type (typically "Get Value By Key" or similar)

3.2: Configure the Get Value By Key Transformation

In the transformation block, select Get Value By Key transformation.

Configure the transformation:

Property: Navigate to and select: Evaluate Raw Alert → Raw Alert → This is the playbook data property that contains the raw alert object

Key: Enter the exact key name from your raw alert JSON that contains the value you want to extract

Example: If your raw alert has {"vendor_id": "12345"}, the key would be vendor_id

Default Value (optional): Set a default value if the key doesn't exist

Navigation Path:

In the property selector, expand: Playbook Properties → Evaluate Raw Alert → result → raw_alert

Or search for: Evaluate_Raw_Alert.result.raw_alert

3.3: Map to CIM Record Field

Locate the Write to CIM Record action in the playbook (typically after the Extract Fields action).

Click Edit on the Write to CIM Record action.

Navigate to Update Fields section.

Add your created CIM field to the Update Fields mapping:

Select the field you created in Step 1

Map the transformation value from Step 3.2 to this field

Ensure the field key name in CIM exactly matches what you're mapping

Example Configuration:

If extracting a vendor_severity field:

Transformation: Get Value By Key from Evaluate_Raw_Alert.result.raw_alert with key vendor_severity

CIM Field: Map to a field named exactly vendor_severity in your CIM application

Step 4: Repeat for Each Field

Repeat Steps 3.1-3.3 for each vendor-specific field you want to extract.

Option 2 - Bulk Mappings (Advanced Transformations)

This approach uses a single advanced transformation block to extract multiple fields at once. Use this method when you have many fields or want to map all fields from the raw alert object.

Step 1: Create Fields in CIM Application

Navigate to Applications → Case and Incident Management (CIM) application.

Create fields of the appropriate types for all the vendor-specific fields you want to map.

Critical: Ensure the field key names in CIM exactly match the key names in your raw alert JSON.

Step 2: Create Advanced Transformation Block

Navigate to Orchestration → Playbooks.

Open the SOC - Extract Raw Alert Fields to CIM playbook.

Locate the Extract Fields action.

Click Edit on the Extract Fields action.

Create an Advanced Transformation Block:

Click "Add Transformation" → "Advanced" or "JSONata"

This allows you to write custom transformation expressions

Step 3: Create JSON Mapping Object

In the advanced transformation block, create a JSON object that maps each raw alert key to the corresponding CIM field. The format is:

{
  "field-key-name-1": actions.Evaluate_Raw_Alert.result.raw_alert.'key-name-1',
  "field-key-name-2": actions.Evaluate_Raw_Alert.result.raw_alert.'key-name-2',
  "field-key-name-3": actions.Evaluate_Raw_Alert.result.raw_alert.'key-name-3'
}

Key Points:

The left side (field key) must exactly match the CIM application field key name

The right side references the raw alert data using: actions.Evaluate_Raw_Alert.result.raw_alert.'key-name'

Use single quotes around key names that contain special characters or spaces

For nested keys, use dot notation: actions.Evaluate_Raw_Alert.result.raw_alert.'nested'.'key'

Example Advanced Transformation:

{
  "vendor_alert_id": actions.Evaluate_Raw_Alert.result.raw_alert.'alert-id',
  "vendor_severity": actions.Evaluate_Raw_Alert.result.raw_alert.severity,
  "vendor_category": actions.Evaluate_Raw_Alert.result.raw_alert.category,
  "custom_metadata": actions.Evaluate_Raw_Alert.result.raw_alert.metadata
}

Step 4: Map to CIM Record

Locate the Write to CIM Record action.

Click Edit on the Write to CIM Record action.

Navigate to Update Fields.

Map the transformation result object as a playbook property:

Select "Playbook Property"

Navigate to the output of your advanced transformation block

Map it to Update Fields

Note: When using bulk mapping, the entire transformation object is mapped to Update Fields, and Turbine automatically matches field keys to CIM application fields.

Handling Different Data Types

Text Fields

Extract directly: actions.Evaluate_Raw_Alert.result.raw_alert.'field-name'

Convert to string if needed: $string(actions.Evaluate_Raw_Alert.result.raw_alert.'field-name')

Number Fields

Extract and ensure numeric type: $number(actions.Evaluate_Raw_Alert.result.raw_alert.'field-name')

Date Fields

Extract and format if needed: actions.Evaluate_Raw_Alert.result.raw_alert.'date-field'

Convert format if necessary using date transformation functions

Array/List Fields

Extract array directly: actions.Evaluate_Raw_Alert.result.raw_alert.'array-field'

Ensure the CIM field type supports arrays/lists

Nested Objects

Access nested properties: actions.Evaluate_Raw_Alert.result.raw_alert.'parent'.'child'

Extract specific nested values as needed

Common Issues and Solutions

Issue: Field Not Appearing in CIM Record

Possible Causes:

Field key name doesn't match exactly between transformation and CIM application

Field doesn't exist in CIM application

Transformation is not extracting the value correctly

Solutions:

Verify field key names match exactly (case-sensitive)

Check that the field exists in the CIM application

Test the transformation to ensure it's extracting the correct value

Check playbook execution logs for errors

Issue: Transformation Returns Null or Undefined

Possible Causes:

Key doesn't exist in raw alert JSON

Key name is misspelled

Nested path is incorrect

Solutions:

Verify the key exists in your raw alert data

Check for typos in key names

Use the raw alert object structure to verify the correct path

Add default values for missing keys: actions.Evaluate_Raw_Alert.result.raw_alert.'key' ?? 'default'

Issue: Data Type Mismatch

Possible Causes:

CIM field expects a different data type than what's being extracted

Transformation is returning wrong type

Solutions:

Verify CIM field type matches the data being extracted

Use type conversion functions in transformation (e.g., $string(), $number())

Check transformation output data types

Best Practices

Field Naming: Use consistent, descriptive field names that match your vendor's terminology

Error Handling: Add default values for optional fields to prevent null errors

Testing: Test mappings with sample data before deploying to production

Documentation: Document which vendor fields map to which CIM fields

Validation: Verify field mappings after any vendor API changes

Performance: Use bulk mappings (Option 2) for many fields to improve performance

Verification

After configuration:

Test the Playbook:

Run the playbook with a sample alert containing vendor-specific fields

Verify that fields are extracted correctly

Check that values appear in CIM records

Validate Field Values:

Compare raw alert values with CIM record values

Ensure data types are correct

Verify special characters and formatting are preserved

Check for Errors:

Review playbook execution logs

Check for any transformation errors

Verify CIM record updates are successful

SOC Solutions BundleSOC Solutions Bundle Overview

Case and Incident Management Application

Turbine Solutions InterfacesTurbine Solutions Interfaces

Configure Custom Case and Incident Management Data Mappings

Prerequisites

Option 1 - Discrete Mappings (Native Transformations)

Step 1: Create Custom Fields in CIM Application

Step 2: Edit the Extract Raw Alert Fields to CIM Playbook

Step 3: Configure Field Extraction

3.1: Create a Transformation Block

3.2: Configure the Get Value By Key Transformation

3.3: Map to CIM Record Field

Step 4: Repeat for Each Field

Option 2 - Bulk Mappings (Advanced Transformations)

Step 1: Create Fields in CIM Application

Step 2: Create Advanced Transformation Block

Step 3: Create JSON Mapping Object

Step 4: Map to CIM Record

Handling Different Data Types

Text Fields

Number Fields

Date Fields

Array/List Fields

Nested Objects

Common Issues and Solutions

Issue: Field Not Appearing in CIM Record

Issue: Transformation Returns Null or Undefined

Issue: Data Type Mismatch

Best Practices

Verification

Related Documentation