{
"fromDate": "0001-01-01T00:00:00Z",
"fromDateLicense": "0001-01-01T00:00:00Z",
"id": "Threat Hunting",
"layout": [
{
"forceRange": false,
"h": 2,
"i": "9c1c65f0-050b-11ee-8890-e7fa67c22acb",
"id": "9c1c65f0-050b-11ee-8890-e7fa67c22acb",
"reflectDimensions": true,
"w": 4,
"widget": {
"Cache": null,
"cacheVersn": 0,
"category": "",
"commitMessage": "",
"created": "0001-01-01T00:00:00Z",
"dataType": "incidents",
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"fromDateLicense": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byFrom": "days",
"byTo": "",
"field": "",
"fromValue": 7,
"toValue": null
},
"toDate": "0001-01-01T00:00:00Z"
},
"definitionId": "",
"fromServerVersion": "",
"id": "391b3dce-2c2a-4f2d-8bb9-a34873ff9223",
"isPredefined": false,
"itemVersion": "",
"modified": "2023-06-07T08:16:29.933539185Z",
"name": "Most Common Suspicious Tool Usage",
"packID": "",
"packName": "",
"params": {
"groupBy": [
"toolusagefound"
],
"showOthers": true,
"valuesFormat": "abbreviated"
},
"prevName": "Most Common Suspicious Tool Usage",
"propagationLabels": [
"all"
],
"query": "type:\"Proactive Threat Hunting\" -toolusagefound:\"\"",
"shouldCommit": false,
"sizeInBytes": 0,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1,
"widgetType": "pie"
},
"x": 0,
"y": 0
},
{
"forceRange": false,
"h": 2,
"i": "cf12a9b0-050b-11ee-8890-e7fa67c22acb",
"id": "cf12a9b0-050b-11ee-8890-e7fa67c22acb",
"reflectDimensions": true,
"w": 4,
"widget": {
"Cache": null,
"cacheVersn": 0,
"category": "",
"commitMessage": "",
"created": "0001-01-01T00:00:00Z",
"dataType": "incidents",
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"fromDateLicense": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byFrom": "days",
"byTo": "",
"field": "",
"fromValue": 7,
"toValue": null
},
"toDate": "0001-01-01T00:00:00Z"
},
"definitionId": "",
"fromServerVersion": "",
"id": "d21cf6af-032d-4dd2-8621-cd2256d7c1b5",
"isPredefined": false,
"itemVersion": "",
"modified": "2023-06-07T08:17:55.628199525Z",
"name": "Top Users Involved In Suspicious Activity",
"packID": "",
"packName": "",
"params": {
"groupBy": [
"affectedusers"
],
"valuesFormat": "abbreviated"
},
"prevName": "Top Hunten Attack Patterns",
"propagationLabels": [
"all"
],
"query": "type:\"Proactive Threat Hunting\" -affectedusers:\"\"",
"shouldCommit": false,
"sizeInBytes": 0,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1,
"widgetType": "pie"
},
"x": 8,
"y": 0
},
{
"forceRange": false,
"h": 4,
"i": "f2cf38f0-050b-11ee-8890-e7fa67c22acb",
"id": "f2cf38f0-050b-11ee-8890-e7fa67c22acb",
"reflectDimensions": true,
"w": 8,
"widget": {
"Cache": null,
"cacheVersn": 0,
"category": "",
"commitMessage": "",
"created": "0001-01-01T00:00:00Z",
"dataType": "incidents",
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"fromDateLicense": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byFrom": "days",
"byTo": "",
"field": "",
"fromValue": 30,
"toValue": null
},
"toDate": "0001-01-01T00:00:00Z"
},
"definitionId": "",
"fromServerVersion": "",
"id": "38e7fad3-7aed-41a7-8fbd-faa73de440b5",
"isPredefined": false,
"itemVersion": "",
"modified": "2023-06-07T08:18:55.625697851Z",
"name": "Latest Threat Hunting Sessions",
"packID": "",
"packName": "",
"params": {
"enablePagination": true,
"tableColumns": [
{
"displayed": true,
"isDefault": true,
"key": "id",
"width": 110
},
{
"displayed": true,
"isDefault": true,
"key": "name",
"width": 300
},
{
"displayed": true,
"isDefault": true,
"key": "status",
"width": 80
},
{
"displayed": true,
"isDefault": true,
"key": "occurred",
"width": 200
}
]
},
"prevName": "Latest Threat Hunting Sessions",
"propagationLabels": [
"all"
],
"query": "type:\"Proactive Threat Hunting\"",
"shouldCommit": false,
"sizeInBytes": 0,
"sort": [
{
"asc": false,
"field": "id",
"fieldType": ""
}
],
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1,
"widgetType": "table"
},
"x": 0,
"y": 3
},
{
"forceRange": false,
"h": 4,
"i": "8fcbf940-050c-11ee-8890-e7fa67c22acb",
"id": "8fcbf940-050c-11ee-8890-e7fa67c22acb",
"reflectDimensions": true,
"w": 4,
"widget": {
"Cache": null,
"cacheVersn": 0,
"category": "",
"commitMessage": "",
"created": "0001-01-01T00:00:00Z",
"dataType": "indicators",
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"fromDateLicense": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byFrom": "days",
"byTo": "",
"field": "",
"fromValue": 7,
"toValue": null
},
"toDate": "0001-01-01T00:00:00Z"
},
"definitionId": "",
"fromServerVersion": "",
"id": "",
"isPredefined": false,
"itemVersion": "",
"modified": "0001-01-01T00:00:00Z",
"name": "SDO Used In Hunting Sessions",
"packID": "",
"packName": "",
"params": {
"tableColumns": [
{
"isDefault": true,
"key": "indicator_type",
"position": 1,
"width": 120
},
{
"isDefault": true,
"key": "value",
"position": 2,
"width": 300
},
{
"isDefault": true,
"key": "score",
"position": 4,
"width": 120
},
{
"isDefault": true,
"key": "firstSeen",
"position": 5,
"width": 275
},
{
"isDefault": true,
"key": "lastSeen",
"position": 6,
"width": 275
},
{
"isDefault": true,
"key": "timestamp",
"position": 8,
"width": 190
},
{
"isDefault": true,
"key": "relatedIncCount",
"position": 9,
"width": 150
},
{
"isDefault": true,
"key": "sourceBrands",
"position": 12,
"width": 175
},
{
"isDefault": true,
"key": "sourceInstances",
"position": 13,
"width": 175
},
{
"isDefault": true,
"key": "expirationStatus",
"position": 14,
"width": 175
},
{
"isDefault": true,
"key": "expiration",
"position": 15,
"width": 190
}
]
},
"prevName": "",
"propagationLabels": [
"all"
],
"query": "incident.type:\"Proactive Threat Hunting\" AND (type:Campaign or type:\"Intrusion Set\" or type:\"Threat Actor\" or type:Malware)",
"shouldCommit": false,
"sizeInBytes": 0,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 0,
"widgetType": "table"
},
"x": 8,
"y": 3
},
{
"forceRange": false,
"h": 1,
"i": "295bbda0-051e-11ee-b130-6992e92c4ea8",
"id": "295bbda0-051e-11ee-b130-6992e92c4ea8",
"reflectDimensions": true,
"w": 8,
"widget": {
"Cache": null,
"cacheVersn": 0,
"category": "",
"commitMessage": "",
"created": "0001-01-01T00:00:00Z",
"dataType": "incidents",
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"fromDateLicense": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byFrom": "days",
"byTo": "",
"field": "",
"fromValue": 7,
"toValue": null
},
"toDate": "0001-01-01T00:00:00Z"
},
"definitionId": "",
"fromServerVersion": "",
"id": "81242adf-2860-4155-8a3a-bd8707ec7611",
"isPredefined": false,
"itemVersion": "",
"modified": "2023-06-07T10:29:17.426061511Z",
"name": "Threat Hunting Sessions Executed",
"packID": "",
"packName": "",
"params": {
"valuesFormat": "abbreviated"
},
"prevName": "Total count of Threat Hunting Session Executed",
"propagationLabels": [
"all"
],
"query": "tags:\"Threat Hunting\"",
"shouldCommit": false,
"sizeInBytes": 0,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1,
"widgetType": "number"
},
"x": 0,
"y": 2
},
{
"forceRange": false,
"h": 2,
"i": "73b93760-051e-11ee-b130-6992e92c4ea8",
"id": "73b93760-051e-11ee-b130-6992e92c4ea8",
"reflectDimensions": true,
"w": 4,
"widget": {
"Cache": null,
"cacheVersn": 0,
"category": "",
"commitMessage": "",
"created": "0001-01-01T00:00:00Z",
"dataType": "incidents",
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"fromDateLicense": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byFrom": "days",
"byTo": "",
"field": "",
"fromValue": 7,
"toValue": null
},
"toDate": "0001-01-01T00:00:00Z"
},
"definitionId": "",
"fromServerVersion": "",
"id": "e9bde988-e523-40bc-837d-62c0aab15755",
"isPredefined": false,
"itemVersion": "",
"modified": "2023-06-07T10:31:22.21854112Z",
"name": "Hosts Contains Suspicious Results",
"packID": "",
"packName": "",
"params": {
"groupBy": [
"affectedhosts"
],
"showOthers": true,
"valuesFormat": "abbreviated"
},
"prevName": "Hosts Contains Suspicious Results",
"propagationLabels": [
"all"
],
"query": "tags:\"Threat Hunting\" -affectedhosts:\"\"",
"shouldCommit": false,
"size": 5,
"sizeInBytes": 0,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1,
"widgetType": "pie"
},
"x": 4,
"y": 0
},
{
"forceRange": false,
"h": 1,
"i": "7f3c1370-05e4-11ee-bc53-7b0c7e963407",
"id": "7f3c1370-05e4-11ee-bc53-7b0c7e963407",
"reflectDimensions": true,
"w": 4,
"widget": {
"Cache": null,
"cacheVersn": 0,
"category": "",
"commitMessage": "",
"created": "0001-01-01T00:00:00Z",
"dataType": "indicators",
"dateRange": {
"fromDate": "0001-01-01T00:00:00Z",
"fromDateLicense": "0001-01-01T00:00:00Z",
"period": {
"by": "",
"byFrom": "days",
"byTo": "",
"field": "",
"fromValue": 7,
"toValue": null
},
"toDate": "0001-01-01T00:00:00Z"
},
"definitionId": "",
"fromServerVersion": "",
"id": "aa5930da-310d-4bc5-8115-4c77d0be8b79",
"isPredefined": false,
"itemVersion": "",
"modified": "2023-06-08T10:08:56.416795659Z",
"name": "Malicious Indicators Found During a Hunt",
"packID": "",
"packName": "",
"params": {
"valuesFormat": "abbreviated"
},
"prevName": "Malicious Indicators Found During a Hunt",
"propagationLabels": [
"all"
],
"query": "tags:\"Hunting Session - Exist In Environment\"",
"shouldCommit": false,
"sizeInBytes": 0,
"toServerVersion": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 1,
"widgetType": "number"
},
"x": 8,
"y": 2
}
],
"name": "Threat Hunting",
"period": {
"by": "",
"byFrom": "days",
"byTo": "",
"field": "",
"fromValue": null,
"toValue": null
},
"toDate": "0001-01-01T00:00:00Z",
"version": -1,
"fromVersion": "6.9.0",
"description": "",
"isPredefined": true
}