{
"associatedToAll": false,
"associatedTypes": [
"Cortex XDR Incident",
"Cortex XDR Port Scan",
"Cortex XDR - Lite"
],
"breachScript": "",
"caseInsensitive": true,
"cliName": "xdrfileartifacts",
"closeForm": false,
"columns": [
{
"displayName": "File Name",
"fieldCalcScript": "",
"isDefault": true,
"isReadOnly": false,
"key": "filename",
"required": false,
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
},
{
"displayName": "File SHA256",
"fieldCalcScript": "",
"isDefault": true,
"isReadOnly": false,
"key": "filesha256",
"required": false,
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
},
{
"displayName": "Alert Count",
"fieldCalcScript": "",
"isDefault": true,
"isReadOnly": false,
"key": "alertcount",
"required": false,
"script": "",
"selectValues": null,
"type": "number",
"width": 150
},
{
"displayName": "File Wildfire Verdict",
"fieldCalcScript": "",
"isDefault": true,
"isReadOnly": false,
"key": "filewildfireverdict",
"required": false,
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
},
{
"displayName": "File Signature Vendor Name",
"fieldCalcScript": "",
"isDefault": true,
"isReadOnly": false,
"key": "filesignaturevendorname",
"required": false,
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
},
{
"displayName": "File Signature Status",
"fieldCalcScript": "",
"isDefault": true,
"isReadOnly": false,
"key": "filesignaturestatus",
"required": false,
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
}
],
"content": true,
"defaultRows": [
{},
{},
{}
],
"description": "",
"editForm": true,
"fieldCalcScript": "",
"group": 0,
"hidden": false,
"id": "incident_xdrfileartifacts",
"isReadOnly": false,
"locked": false,
"name": "XDR File Artifacts",
"neverSetAsRequired": false,
"ownerOnly": false,
"placeholder": "",
"required": false,
"script": "",
"selectValues": [],
"sla": 0,
"system": false,
"systemAssociatedTypes": null,
"threshold": 72,
"type": "grid",
"unmapped": false,
"unsearchable": false,
"useAsKpi": false,
"validationRegex": "",
"version": -1,
"fromVersion": "5.0.0"
}