Fix Microsoft Defender incoming mapper / XSUP-45575 (#38155)

RosenbergYehuda · sdaniel6 · commit 7862aaa4841c · 2025-01-27T11:14:08.000+02:00
* init

* rn

* rn
diff --git a/Packs/Microsoft365Defender/Classifiers/classifier-Microsoft_365_Defender_-_Incoming_Mapper.json b/Packs/Microsoft365Defender/Classifiers/classifier-Microsoft_365_Defender_-_Incoming_Mapper.json
@@ -309,7 +309,7 @@
                                         "isContext": false,
                                         "value": {
                                             "complex": null,
-                                            "simple": "0"
+                                            "simple": "0.5"
                                         }
                                     },
                                     "toReplace": {
diff --git a/Packs/Microsoft365Defender/ReleaseNotes/4_5_40.json b/Packs/Microsoft365Defender/ReleaseNotes/4_5_40.json
@@ -0,0 +1,4 @@
+{
+    "breakingChanges": true,
+    "breakingChangesNotes": "The `severity` incident field will now map `Informational` in Microsoft 365 Defender to `Informational` in XSOAR instead of `Unknown`."
+}
diff --git a/Packs/Microsoft365Defender/ReleaseNotes/4_5_40.md b/Packs/Microsoft365Defender/ReleaseNotes/4_5_40.md
@@ -0,0 +1,6 @@
+
+#### Mappers
+
+##### Microsoft 365 Defender - Incoming Mapper
+
+Updated the `severity` incident field to be correctly mapped.
diff --git a/Packs/Microsoft365Defender/pack_metadata.json b/Packs/Microsoft365Defender/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Microsoft 365 Defender",
     "description": "Microsoft Defender XDR (formerly Microsoft 365 Defender) is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.",
     "support": "xsoar",
-    "currentVersion": "4.5.39",
+    "currentVersion": "4.5.40",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Original file line number	Diff line number	Diff line change
`@@ -309,7 +309,7 @@`
`309`	`309`	`"isContext": false,`
`310`	`310`	`"value": {`
`311`	`311`	`"complex": null,`
`312`		`- "simple": "0"`
	`312`	`+ "simple": "0.5"`
`313`	`313`	`}`
`314`	`314`	`},`
`315`	`315`	`"toReplace": {`
-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +{
 +    "breakingChanges": true,
 +    "breakingChangesNotes": "The `severity` incident field will now map `Informational` in Microsoft 365 Defender to `Informational` in XSOAR instead of `Unknown`."
 +}