Most security teams rely on many services to protect their organization from cyber-related incidences. Unfortunately, normalizing data from these different services in order to conduct an analysis or investigation is often a very manual process. However, with Perygee’s import tool you can unify data from disparate services and spreadsheets with ease.
Starting an import
First, navigate to the admin console by clicking the “Admin console” text button from the left side panel or by clicking the Perygee logo in the top left. Then click the orange “Import Data” button from the left menu.
A modal will appear asking you where you would like to import your data from. You have the option to import from a CSV, custom integration, or from a common source such as ServiceNow or Dragos.
After you select your data source and complete the corresponding steps, a wizard with a preview of the import data will appear. From the wizard you must choose the main import item type. You can also choose to hide certain columns by clicking the “Ignore column” button. Note that this is optional and columns can be unhidden later. Once you’re ready, click the “Map columns” button.
Mapping columns
The mapping columns page has three distinct areas. On the bottom is a view of your import data, the top left is a graphical model of your data, and the top right is the display pane where you can see or edit current selections.
First, open the attribute list by clicking the left arrow on the main item type node. Note that the number on the node refers to the number of pre-defined attributes that Perygee associates with that item type. Next, find the column that you wish to use as the “key” identifier. This is often a unique identifier such as an asset ID. Perygee helps your decision by displaying a key icon and an “All Unique” label on columns where the values are all unique. Once identified, drag and drop the column title on the attribute within the item type node to make a new mapping. For example, in the image below we are dragging the “MAC” column and dropping it on to the “MAC Address” attribute. Then from the display pane on the right, select the radio button next to the key icon to indicate that this is the key identifier for the import.
Once your key column is mapped, you can review and normalize the import data by clicking the pencil icon on the key column from the import data section. This will open a modal where you can see the number of new items (no matches to existing data), multiple possible matches, one likely match, and exact matches. You can also make changes in this modal such as ignoring certain values or changing the text on others.
The next step is to map the other columns you wish to import. You will follow the same steps as mapping the key column with the exception of selecting the key icon and reviewing the import. Instead, you will have the option to create, update, or delete for each new mapping. By default, Create and Update are selected, but they can be edited from the display pane on the right.
- Create: blank values will be filled in with new values
- Update: existing values will be updated to new values
- Delete: existing values will be deleted if the incoming value is empty
Connecting new item types
To connect a new item type in your data model simply drag an edge from the top or bottom of an existing node. A new node and link will be created. With the node selected, you can choose an item type from the dropdown menu in the display pane. Mapping columns to attributes is the same as above.
You can define the link type by first selecting the link from the graph and then choosing the type from the dropdown menu in the display pane. It’s important to define the relationship between item types so you can create more sophisticated queries for your dashboards and automations.