CrowdStrike Falcon Behaviour Pattern Disposition Details

Details

ID	`incident_crowdstrikefalconbehaviourpatterndispositiondetails`
CLI Name	`crowdstrikefalconbehaviourpatterndispositiondetails`
Type	grid
Version	-1
Required	No
Read Only	No
Use as KPI	No
Searchable	No
Associated Incident Types

CrowdStrike Falcon Detection
Source

incidentfield-Behaviour_Pattern_Disposition_Details.json
Download History Raw
{
    "associatedToAll": false,
    "associatedTypes": [
		"CrowdStrike Falcon Detection"
	],
    "caseInsensitive": true,
    "cliName": "crowdstrikefalconbehaviourpatterndispositiondetails",
    "closeForm": false,
    "columns": [
        {
            "displayName": "Rooting",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "rooting",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Fs Operation Blocked",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "fsoperationblocked",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Detect",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "detect",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Blocking Unsupported or Disabled",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "blockingunsupportedordisabled",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Kill Action Failed",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "killactionfailed",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Bootup Safeguard Enabled",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "bootupsafeguardenabled",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Policy Disabled",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "policydisabled",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Kill Parent",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "killparent",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Suspend Process",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "suspendprocess",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Critical Process Disabled",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "criticalprocessdisabled",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Quarantine File",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "quarantinefile",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Suspend Parent",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "suspendparent",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Kill Process",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "killprocess",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Indicator",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "indicator",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Kill Subprocess",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "killsubprocess",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Sensor Only",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "sensoronly",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Registry Operation Blocked",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "registryoperationblocked",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Operation Blocked",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "operationblocked",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Quarantine Machine",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "quarantinemachine",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Inddet Mask",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "inddetmask",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Process Blocked",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "processblocked",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        },
        {
            "displayName": "Handle Operation Downgraded",
            "fieldCalcScript": "",
            "isDefault": true,
            "isReadOnly": false,
            "key": "handleoperationdowngraded",
            "orgType": "boolean",
            "required": false,
            "script": "",
            "selectValues": null,
            "type": "boolean",
            "width": 150
        }
    ],
    "content": true,
    "defaultRows": [
        {},
        {},
        {}
    ],
    "editForm": true,
    "group": 0,
    "hidden": false,
    "id": "incident_crowdstrikefalconbehaviourpatterndispositiondetails",
    "isReadOnly": false,
    "locked": false,
    "name": "CrowdStrike Falcon Behaviour Pattern Disposition Details",
    "neverSetAsRequired": false,
    "openEnded": false,
    "ownerOnly": false,
    "required": false,
    "sla": 0,
    "system": false,
    "threshold": 72,
    "type": "grid",
    "unmapped": false,
    "unsearchable": true,
    "useAsKpi": false,
    "version": -1,
    "fromVersion": "6.8.0",
    "marketplaces": [
        "xsoar"
    ]
}