Integrations
Targets & Mappings
Connect SIEM targets, keep read-only or auto-sync settings, manage field mappings, log source mappings, and apply suggested overrides.
Overview
Targets are the SIEM or detection platforms CraftedSignal reads from, tests against, and deploys to. They are managed under Detection > Targets.
Targets currently include Splunk, Microsoft Sentinel, Elastic Security, CrowdStrike, and Rapid7 InsightIDR depending on enabled integrations.
Target settings
A target can include:
- Name and description.
- Platform type.
- API URL or platform-specific workspace settings.
- API token, client secret, or webhook settings.
- Splunk HEC settings for test event injection.
- Automatic rule sync toggle.
- Read-only mode.
Read-only targets block deployments, drift fixes, and test event injection. They are still useful for import, visibility, and health checks.
Field mappings
Field mappings override how Sigma fields translate to target-specific field names.
Example:
| Sigma field | Platform field |
|---|---|
Image | process_name |
CommandLine | process_command_line |
ParentImage | parent_process_name |
Use field mappings when your SIEM schema differs from the default compiler assumptions. Mappings are saved immediately when added or removed.
Log source mappings
Log source mappings tell the compiler which table, index, sourcetype, log set, or event type to use for a Sigma logsource combination.
For Splunk, a mapping can include index and sourcetype. For Sentinel, the same concept maps to a table. For Rapid7 it maps to a log set. For CrowdStrike it maps to an event type.
Suggested overrides
The target edit page can analyze Sigma rules and suggest missing field or log source mappings. Suggestions can be applied one by one or in bulk above a confidence threshold.
Use this workflow after importing rules from a new source, connecting a new target, or seeing unmapped fields in compiled previews.
When to update mappings
Update mappings when:
- A compiled query references fields that do not exist in the target.
- A rule has the right logic but runs against the wrong table, index, or sourcetype.
- A new telemetry source lands in the SIEM with different naming.
- Simulations or live tests produce telemetry but detections do not match.
- Coverage recompute shows weak or missing telemetry for modeled attack paths.
Related docs
- Platform Guides - connection details by SIEM.
- Rules - compiled previews and mapping warnings.
- Testing - test execution against connected targets.
- Simulations - simulation results that expose mapping gaps.