How to map the payload field to the SOAR Webhook Fields in Google SecOps SOAR? (Severity Mapping, Nested IfElse, and Storing Full JSON)

Take a look at these docs and community posts for some help here:
Set up a webhook
Else if condition SecOps
create entities from data ingested via webhook
No Raw Event Data for Webhook Ingested event
Create a custom connector
 

Hi ​@kentphelps 

Thanks for the response and the documentation links!

I was able to successfully map the **rawEvent** data in the Alert, which addresses point #4. However, I'm still facing challenges with the other points:

---

### 1. Missing Field Mappings in Webhook Configuration

In the Alert object, I can see several fields that I'd like to populate:
- Severity
- Product Name
- Risk Score
 

However, these fields don't appear in the webhook field mapping options. Are these fields supported for webhook mapping? If so, how can I access them?

This is especially important for **Severity** mapping since I need to set alert priority based on my payload's `classification` field.

---

### 2. Nested If-Else in Expression Builder

The documentation mentions `IfThenElse` support, but I couldn't find specific guidance on **nested conditions** for webhook field mappings.

I'm trying to map severity based on the `classification` field from my payload using nested `IfThenElse` like this:

```
classification | ifthenelse("=","malicious","CRITICAL", ifthenelse("=","suspicious","HIGH", ifthenelse("=","benign","MEDIUM", ifthenelse("=","unknown","LOW","NONE"))))
```

**Expected behavior:** Map classification values to severity levels:
- `malicious` → `CRITICAL`
- `suspicious` → `HIGH`
- `benign` → `MEDIUM`
- `unknown` → `LOW`

**Actual result:** Returns `[object Object]` instead of the expected string value.

Is nested `IfThenElse` supported in webhook expression mappings? If not, is there an alternative approach to achieve this multi-condition mapping?

---

### 3. Combining Multiple Fields for Alert Name / Rule ID

I'd like to combine multiple payload fields to create a custom **Alert Name** or **Rule ID**. For example:

```
"[Platform] {classification} activity detected from {ip} at {timestamp}"
```

This would help me:
- Easily identify alerts from this specific webhook integration
- Trigger custom playbooks based on a naming convention or prefix

Is there a way to concatenate multiple fields in the expression builder? Something like:
```
"[Platform] " + classification + " - " + ip
```

---

Any guidance on these specific webhook mapping capabilities would be greatly appreciated!

Thanks!

The webhook behavior can be handled as follows.

1. Severity and risk mapping

For SOAR webhook ingestion, use the top-level field Priority rather than Severity.

Priority must be an integer from 0–100:

80–100: Critical

60–79: High

40–59: Medium

20–39: Low

0–19: Informative

DeviceProduct can also be mapped as a top-level field.

Risk Score does not appear to be directly available as a standard webhook mapping field. Preserve the source score inside the raw event and, when needed, update the alert risk score later through a playbook action.

For the requested classification mapping:

malicious -> 80

suspicious -> 60

benign -> 40

unknown -> 20

I would perform this conversion in the sending platform before submitting the webhook. The webhook mapper works best for basic transformations rather than complex conditional logic.

2. Nested ifThenElse

The expression format is:

value | ifThenElse(

"operator",

"comparedValue",

"trueResult",

"falseResult"

)

Nested ifThenElse expressions do not appear to evaluate reliably inside the result arguments.

Receiving [object Object] indicates that the inner expression is likely being serialized as an object rather than evaluated as a string value.

I would not use nested ifThenElse for this mapping. Generate the numeric Priority upstream or use a custom connector for more advanced transformation logic.

3. Combining fields

The Expression Builder supports join() for joining an array of strings:

[platform, classification, ip] | join(" - ")

Example output:

Platform - malicious - 1.2.3.4

Test it using Run in the webhook mapping screen because the source fields must resolve as an array of strings.

For playbook selection, use a stable RuleGenerator value rather than including dynamic values such as the IP address or timestamp.

Example:

RuleGenerator: PLATFORM_MALICIOUS

Name: [Platform] malicious activity from 1.2.3.4

A stable RuleGenerator is better for deterministic playbook triggering than a fully dynamic alert name.

4. Retaining the full JSON

Place the complete original event object inside the top-level EventsList array.

Even a single event should be wrapped inside the array.

{

"TicketId": "f7167971-f641-432f-a06f-ebca3caaa9dd",

"DisplayId": "f7167971-f641-432f-a06f-ebca3caaa9dd",

"SourceSystemName": "Platform Webhook",

"Name": "[Platform] malicious activity from 1.2.3.4",

"DeviceVendor": "Example Vendor",

"DeviceProduct": "Example Product",

"RuleGenerator": "PLATFORM_MALICIOUS",

"StartTime": [removed by moderator] ,

"Priority": 80,

"EventsList": [

{

"classification": "malicious",

"ip": "1.2.3.4",

"timestamp": "2026-07-20T15:00:00Z",

"risk_score": 91,

"original_field_1": "value",

"original_field_2": "value"

}

]

}

The required alert fields can then be mapped from the payload while the remaining original properties stay available inside the raw event.

I 🤔 most, if not all of this is in Google Cloud docs.

RQ whathehack81