# Mapping only specific attributes in the Vision One integration

**URL:** <https://discuss.elastic.co/t/mapping-only-specific-attributes-in-the-vision-one-integration/371209>\
**Category:** Elastic Agent\
**Created:** [November 28, 2024, 4:29pm UTC](https://discuss.elastic.co/t/mapping-only-specific-attributes-in-the-vision-one-integration/371209 "2024-11-28T16:29:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cyberm](https://avatars.discourse-cdn.com/v4/letter/c/3ab097/32.png) [@cyberm](https://discuss.elastic.co/u/cyberm)\
**Post date:** [November 28, 2024, 4:29pm UTC](https://discuss.elastic.co/t/mapping-only-specific-attributes-in-the-vision-one-integration/371209/1 "2024-11-28T16:29:33Z")

</div>

Hi everyone,

I’m currently doing a full analysis of all the attributes I’m receiving through the default setup of the Vision One integration (Trend Micro) in Elasticsearch. While reviewing the data, I started wondering:

How can I map only the attributes I’m really interested in from this integration and ensure that this mapping remains consistent?

I’d like to optimize the integration to focus only on the data that’s useful for my needs, but I’m unsure if this is the best approach.

Does it make sense to customize the mapping this way, or is it better to stick with the default setup? What would you recommend based on your experience?

Any advice or ideas are welcome!

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 28, 2024, 4:53pm UTC](https://discuss.elastic.co/t/mapping-only-specific-attributes-in-the-vision-one-integration/371209/2 "2024-11-28T16:53:55Z")

</div>

Hi @cyberm Relating to your other post (and do we really need 2 seperate threads perhaps we should close one

Look at

> **[Data streams | Fleet and Elastic Agent Guide \[8.16\] | Elastic](https://www.elastic.co/guide/en/fleet/8.16/data-streams.html#data-streams-index-templates)**

and caution...

> WARNING!  
> Custom index mappings may conflict with the mappings defined by the integration and may break the integration in Kibana. Do not change or customize any default mappings.
> 
> When you install an integration, Fleet creates two default `@custom` component templates:
> 
> - A `@custom` component template allowing customization across all documents of a given data stream type, named following the pattern: `<data_stream_type>@custom`.
> - A `@custom` component template for each data stream, named following the pattern: `<name_of_data_stream>@custom`.