I’ve set up a custom connector and successfully ingested alerts into the platform. However, when attempting to map entities for the event on the ontology page, it shows "unknown_event_type." I’m uncertain about how to define the event type within a custom connector. Could you guide me on this?
Solved
How can I set the event type in a custom connector?
+6- Bronze 5
Best answer by f3rz
Hi @jaymin it determines by event_name, please see more: https://cloud.google.com/chronicle/docs/soar/respond/start-developing/developing-the-connector
+10Hi @jaymin it determines by event_name, please see more: https://cloud.google.com/chronicle/docs/soar/respond/start-developing/developing-the-connector
+12Are you setting
event["event_type"] =
+6- Bronze 5
Are you setting
event["event_type"] =
No, I was using event["event_name"] =,
but the main reason for the event type not setting is that I did not add "event_name" value under the "Event Field Name" configuration option of the connector. Once I did this, I am able to see the event type being set.
Thanks.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.