XDR Alerts

Cortex XDR by Palo Alto Networks grid

Details

IDincident_xdralerts
CLI Namexdralerts
Typegrid
Version-1
RequiredNo
Read OnlyNo
Use as KPINo
SearchableYes
{
	"associatedToAll": false,
	"associatedTypes": [
		"Cortex XDR Incident",
		"Cortex XDR Port Scan",
        "Cortex XDR - Lite"
	],
	"breachScript": "",
	"caseInsensitive": true,
	"cliName": "xdralerts",
	"closeForm": false,
	"columns": [
		{
			"displayName": "Alert Id",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "alertid",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Detection Timestamp",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "detectiontimestamp",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Severity",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "severity",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Name",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "name",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Category",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "category",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Action",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "action",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Action Pretty",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "actionpretty",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Description",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "description",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Host IP",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "hostip",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "Host Name",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "hostname",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "User Name",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "username",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "MITRE ATTACK TACTIC",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "mitretacticidandname",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		},
		{
			"displayName": "MITRE ATTACK TECHNIQUE",
			"fieldCalcScript": "",
			"isDefault": true,
			"isReadOnly": false,
			"key": "mitretechniqueidandname",
			"required": false,
			"script": "",
			"selectValues": null,
			"type": "shortText",
			"width": 150
		}
	],
	"content": true,
	"defaultRows": [
		{},
		{},
		{}
	],
	"description": "",
	"editForm": true,
	"fieldCalcScript": "",
	"group": 0,
	"hidden": false,
	"id": "incident_xdralerts",
	"isReadOnly": false,
	"locked": false,
	"name": "XDR Alerts",
	"neverSetAsRequired": false,
	"ownerOnly": false,
	"placeholder": "",
	"required": false,
	"script": "",
	"selectValues": [],
	"sla": 0,
	"system": false,
	"systemAssociatedTypes": null,
	"threshold": 72,
	"type": "grid",
	"unmapped": false,
	"unsearchable": false,
	"useAsKpi": false,
	"validationRegex": "",
	"version": -1,
	"fromVersion": "5.0.0"
}