Files | Upload with Custom data mapping#

With custom data mapping, you can upload one CSV file at a time to have the structured data in it extracted according to a template you already defined or a template you define during the import.

Note

Files uploaded in Custom data mapping have a maximum size of 10MB.

  1. In the left navigation bar, select + Create > Upload Upload.

  2. Under Data mapped CSV import Custom data mapping in the pop-up, select Upload >.

  3. Browse your network for files/archives, or drag and drop files into the modal.
    To delete a file from the list of uploaded files, select the X to the right of its name.

  4. In the Source field, select a group. All entities and observables ingested from the uploaded files will have this group assigned as their source.

  5. (Optional) Select the following options if they apply to your upload(s):

    Option

    Description

    Override source reliability:

    Set a source reliability for all incoming objects.

    Extract observables from unstructured text:

    Select this option to parse the text in uploaded files and create observables that match well-known text patterns.

    Password protected archive:

    Allows you to provide the password when uploading password protected archives.

    Add information source details:

    Add the below listed information to the source for uploaded files.

    Field

    Description

    Description

    Provide a source description.

    Identity

    Name of source.

    Roles

    Select at least one of the following roles:

    • Initial Author

    • Content Enhancer/Refiner

    • Aggregator

    • Transformer/Translater

    References

    Set one or more URLs.

    Override TLP:

    Override TLP values for all incoming objects.

  6. In the Data mapping, either:

    1. Select a saved Data mapping template.
      See Data mapping templates to learn more.

    2. Then select Start import from the bottom right to start importing this CSV file.

    Or:

    1. Select Custom mapping to create a custom CSV mapping in the next step.

    2. Select Continue from the bottom right to start creating a custom mapping for this file import.

      See Create mapping at upload below to learn more.

Create mapping at upload#

When you select Custom mapping when you manually upload files, selecting Continue brings you to a set of configuration pages where you can define a custom mapping for your uploaded CSV file.

  1. In the Parameters section, set these options:

    Delimiter

    Default: Comma (,) Select a delimiter character for this mapping.

    Quote character

    Default: "

    Set a quote character (max. 1 character). Text enclosed by this character is interpreted as belonging to a single field.

    Parse tags

    Select to allow parsing multiple tags from a single entity.tags field.

    Ignore lines that start with #

    Select to ignore comment-like lines in file (i.e. line starts with #).

    First row doesn’t contain header names

    By default, the first row of a CSV file is interpreted as a row of headings/column names.

    Select to interpret the first row as data.

  2. Select Continue.

  1. Here, the custom-data-mapping tool detects CSV header names and provides a preview of the contents of each field.

    Set the Matching field in EclecticIQ for each field to map it.

    Data mapping example.

  2. (Optional) Select Save template to save this mapping.

  3. Select Start import to start importing your CSV file.