I’ve set up a custom connector and successfully ingested alerts into the platform. However, when attempting to map entities for the event on the ontology page, it shows "unknown_event_type." I’m uncertain about how to define the event type within a custom connector. Could you guide me on this?
Solved! Go to Solution.
Hi @jaymin it determines by event_name, please see more: https://cloud.google.com/chronicle/docs/soar/respond/start-developing/developing-the-connector
Hi @jaymin it determines by event_name, please see more: https://cloud.google.com/chronicle/docs/soar/respond/start-developing/developing-the-connector
Are you setting
No, I was using event["event_name"] =,
but the main reason for the event type not setting is that I did not add "event_name" value under the "Event Field Name" configuration option of the connector. Once I did this, I am able to see the event type being set.
Thanks.