Files | Upload with Custom data mapping#
With custom data mapping, you can upload one CSV file at a time to have the structured data in it extracted according to a template you already defined or a template you define during the import.
Note
Files uploaded in Custom data mapping have a maximum size of 10MB.
Browse your network for files/archives, or drag and drop files into the modal.
To delete a file from the list of uploaded files, select the X to the right of its name.In the Source field, select a group. All entities and observables ingested from the uploaded files will have this group assigned as their source.
(Optional) Select the following options if they apply to your upload(s):
Option
Description
Override source reliability:
Set a source reliability for all incoming objects.
Extract observables from unstructured text:
Select this option to parse the text in uploaded files and create observables that match well-known text patterns.
Password protected archive:
Allows you to provide the password when uploading password protected archives.
Add information source details:
Add the below listed information to the source for uploaded files.
Field
Description
Description
Provide a source description.
Identity
Name of source.
Roles
Select at least one of the following roles:
Initial Author
Content Enhancer/Refiner
Aggregator
Transformer/Translater
References
Set one or more URLs.
Override TLP:
Override TLP values for all incoming objects.
In the Data mapping, either:
Select a saved Data mapping template.
See Data mapping templates to learn more.Then select Start import from the bottom right to start importing this CSV file.
Or:
Select Custom mapping to create a custom CSV mapping in the next step.
Select Continue from the bottom right to start creating a custom mapping for this file import.
See Create mapping at upload below to learn more.
Create mapping at upload#
When you select Custom mapping when you manually upload files, selecting Continue brings you to a set of configuration pages where you can define a custom mapping for your uploaded CSV file.
In the Parameters section, set these options:
Delimiter
Default: Comma (
,
) Select a delimiter character for this mapping.Quote character
Default:
"
Set a quote character (max. 1 character). Text enclosed by this character is interpreted as belonging to a single field.
Parse tags
Select to allow parsing multiple tags from a single
entity.tags
field.Ignore lines that start with #
Select to ignore comment-like lines in file (i.e. line starts with
#
).First row doesn’t contain header names
By default, the first row of a CSV file is interpreted as a row of headings/column names.
Select to interpret the first row as data.
Select Continue.
Here, the custom-data-mapping tool detects CSV header names and provides a preview of the contents of each field.
Set the Matching field in EclecticIQ for each field to map it.
(Optional) Select Save template to save this mapping.
Select Start import to start importing your CSV file.