After installing and configuring an integration, you need to map their fields
to Google Security Operations fields in order to show the information in the platform.
When configuring the Elasticsearch connector, you need to convert
or map the custom date and time, such as \_source\_@timestamps, to
startTime and endTime of Google SecOps cases.
Navigate to SOAR Settings > Ontology > Ontology
Status.
Click
settings
Configure in the same row as the Elasticsearch connector.
In the Event Configuration page, select Mapping.
Under System Fields, select the StartTime row and choose
Edit Field from the menu.
In the Map Target Field: StartTime dialog:
For Extracted Field, select \_source\_@timestamp, which is
from the ELK stack.
For Transformation Function, select FROM_CUSTOM_DATETIME
from the menu.
In the Enter Parameters field, enter YYYY-MM-DDTHH:MM:SS:zzzZ.
In the Map Target Field: EndTime dialog:
For Extracted Field, select \_source\_@timestamp, which is
from the ELK stack.
For Transformation Function, select FROM_CUSTOM_DATETIME
from the menu.
In the Enter Parameters field, enter
YYYY-MM-DDTHH:MM:SS:zzzZ. This is to generalize the time
format.
Click Save.
The Elasticsearch timestamp fields are now converted to the standardized time
and date fields.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-06 UTC."],[[["The Elasticsearch connector in Google SecOps requires mapping custom date and time fields to the platform's **startTime** and **endTime** fields for proper data display."],["To map a custom timestamp, navigate to **SOAR Settings \u003e Ontology \u003e Ontology Status**, and configure the Elasticsearch connector, specifically under the **Event Configuration** and then the **Mapping** section."],["Both the **StartTime** and **EndTime** fields should be configured with the **\\_source\\_@timestamp** extracted field and the **FROM_CUSTOM_DATETIME** transformation function."],["When setting up the transformation function, provide the `YYYY-MM-DDTHH:MM:SS:zzzZ` format in the **Enter Parameters** field for both **StartTime** and **EndTime** to standardize the time."]]],[]]
