def data_mapping(self, indicator_data):
        """To map the data and create indicators into sentinel."""
        __method_name = inspect.currentframe().f_code.co_name
        try:
            report_data = []
            checkpoint = ""
            for indicator in indicator_data:
                checkpoint = indicator.get("attributes", {}).get("updated_at", "")
                data = {"kind": "indicator"}
                data["properties"] = {}

                source_cofence = self.source_mapping(indicator)
                if source_cofence:
                    data["properties"]["source"] = source_cofence
                else:
                    applogger.debug(
                        "{}(method={}) : {} : skipping the sentinel indicator.".format(
                            LOGS_STARTS_WITH,
                            __method_name,
                            COFENSE_TO_SENTINEL,
                        )
                    )
                    data = {}
                    continue
                indicator_id = indicator.get("id", "")
                data["properties"]["displayName"] = "Cofense Triage : {}".format(indicator_id)
                indicator_threat_level = indicator.get("attributes", {}).get("threat_level", "")
                threat_level = cofense_to_sentinel_threat_level_mapping(indicator_threat_level, COFENSE_TO_SENTINEL)
                data["properties"]["confidence"] = threat_level

                indicator_threat_type = indicator.get("attributes", {}).get("threat_type", "")
                threat_type = self.pattern_type_mapping(indicator_threat_type)

                if threat_type:
                    data["properties"]["patternType"] = threat_type
                else:
                    applogger.debug(
                        "{}(method={}) : {} : skipping the threat type {}".format(
                            LOGS_STARTS_WITH,
                            __method_name,
                            COFENSE_TO_SENTINEL,
                            indicator_threat_type,
                        )
                    )
                    data = {}
                    continue
                data["properties"]["threatTypes"] = [threat_type]
                indicator_threat_value = indicator.get("attributes", {}).get("threat_value", "")
                pattern = self.pattern_mapping(threat_type, indicator_threat_value, indicator_threat_type)
                if pattern:
                    data["properties"]["pattern"] = pattern
                else:
                    applogger.debug(
                        "{}(method={}) : {} : skipping the threat type {}".format(
                            LOGS_STARTS_WITH,
                            __method_name,
                            COFENSE_TO_SENTINEL,
                            indicator_threat_type,
                        )
                    )
                    data = {}
                    continue
                data["properties"]["created"] = indicator.get("attributes", {}).get("created_at", "")
                data["properties"]["externalLastUpdatedTimeUtc"] = indicator.get("attributes", {}).get("updated_at", "")
                report_link = self.report_link_mapping(indicator)
                indicator_response = self.microsoft_obj.create_indicator(data, indicator_id)
                if indicator_response is None:
                    failed_indicator = {"indicator": data, "report_link": report_link, "id": indicator_id}
                    self.save_failed_indicators(failed_indicator)
                    continue
                indicator_externalId = indicator_response.get("properties", {}).get("externalId", "")
                applogger.debug(
                    "{}(method={}) : {}: indicator created successfully.".format(
                        LOGS_STARTS_WITH, __method_name, COFENSE_TO_SENTINEL
                    )
                )
                updated_at = indicator.get("attributes", {}).get("updated_at", "")
                reportdata = {
                    "indicator_id": indicator_id,
                    "external_id": "{}-{}".format(indicator_externalId, source_cofence),
                    "report_link": report_link,
                    "updated_at": updated_at,
                }
                report_data.append(reportdata)
                data = {}
            return report_data, checkpoint
        except CofenseException:
            raise CofenseException()
        except Exception as error:
            applogger.error(
                "{}(method={}) : {} : error occurred while mapping data of indicators : {}.".format(
                    LOGS_STARTS_WITH, __method_name, COFENSE_TO_SENTINEL, error
                )
            )
            raise CofenseException()
To map the data and create indicators into sentinel.
Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/CofenseBasedIndicatorCreator/cofense_to_sentinel_mapping.py