Cortex Toolbox Kitlist Builder Ingest Calculator

Content ▾

Packs Integrations Playbooks Scripts

Incident Types Incident Fields Classifiers Layouts

Parsing Rules Correlation Rules Modeling Rules

Reputation Commands Threat Feeds

Docs ▾

Documentation Analytics Alerts XDM Explorer

Settings ▾

Show test playbooks Show deprecated content

Sign in

Incident Fields / End Time

End Time

The time when the offense ended.

Common Types shortText

Details

ID	`incident_endtime`
CLI Name	`endtime`
Type	shortText
Version	-1
Required	No
Read Only	No
Use as KPI	No
Searchable	Yes

Associated Incident Types

Guardicore Incident
Graph Security Alert
CrowdStrike Falcon IDP Detection
Exabeam Notable User
CrowdStrike Falcon NGSIEM Detection
CrowdStrike Falcon NGSIEM Incident
CrowdStrike Falcon NGSIEM Case

Cortex Toolbox v0.1.0 — a community tool, not an official Palo Alto Networks product. Estimates are indicative; validate sizing with your Palo Alto Networks representative.