Malware

Malware Core · #80DEEA
Details

ID	`Malware`
Version	-1
From Version	6.1.0
Playbook	Endpoint Malware Investigation - Generic V2
Auto-run	No
Disabled	No
Read Only	No
Default	No
Source

incidenttype-Malware_6.1.json
Download History Raw
{
    "autorun": false,
    "color": "#80DEEA",
    "days": 0,
    "daysR": 0,
    "default": false,
    "detached": false,
    "disabled": false,
    "extractSettings": {
        "fieldCliNameToExtractSettings": {
            "agentid": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "alertid": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "alertname": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "app": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "assigneduser": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "assignmentgroup": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "attachment": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "blockedaction": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "caller": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "category": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "closenotes": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "closinguserid": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "commandline": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "country": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "criticalassets": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "cve": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [
                    "cveRep"
                ],
                "isExtractingAllIndicatorTypes": false
            },
            "cvss": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "dbotmirrorid": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "dbotprediction": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "dest": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": true
            },
            "destinationhostname": {
                "extractAsIsIndicatorTypeId": "hostRep",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "destinationip": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [
                    "IPv6",
                    "ipRep"
                ],
                "isExtractingAllIndicatorTypes": false
            },
            "destinationnetwork": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "destinationport": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "destntdomain": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "details": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "detectionurl": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [
                    "urlRep"
                ],
                "isExtractingAllIndicatorTypes": false
            },
            "deviceexternalip": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "devicehash": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "devicelocalip": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "devicemodel": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "devicename": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "droppedcount": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "escalation": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "eventid": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "eventtype": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "feedbased": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "filehash": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [
                    "unifiedFileRep"
                ],
                "isExtractingAllIndicatorTypes": false
            },
            "filename": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "filepath": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "filesize": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "firstname": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "firstseen": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "hostname": {
                "extractAsIsIndicatorTypeId": "hostRep",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "incomingmirrorerror": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "infectedhosts": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "investigationstage": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "isolated": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "labels": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "lastname": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "linkedcount": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "logsource": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "macaddress": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "maliciousbehavior": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "malwarefamily": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "md5": {
                "extractAsIsIndicatorTypeId": "unifiedFileRep",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "mobiledevicemodel": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "name": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "os": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "osversion": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "outgoingmirrorerror": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "phonenumber": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "pid": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "protocol": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "quarantined": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "runstatus": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "sha1": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [
                    "unifiedFileRep"
                ],
                "isExtractingAllIndicatorTypes": false
            },
            "sha256": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [
                    "unifiedFileRep"
                ],
                "isExtractingAllIndicatorTypes": false
            },
            "sha512": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [
                    "unifiedFileRep"
                ],
                "isExtractingAllIndicatorTypes": false
            },
            "signature": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "sourcebrand": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "sourcehostname": {
                "extractAsIsIndicatorTypeId": "hostRep",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "sourceinstance": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "sourceip": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [
                    "IPv6",
                    "ipRep"
                ],
                "isExtractingAllIndicatorTypes": false
            },
            "sourcenetwork": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "sourceport": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "sourceusername": {
                "extractAsIsIndicatorTypeId": "accountRep",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "src": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": true
            },
            "srcntdomain": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "srcos": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "state": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "subcategory": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "tenantname": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "terminatedaction": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "threatactor": {
                "extractAsIsIndicatorTypeId": "Threat Actor",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "ticketnumber": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "urlsslverification": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "user": {
                "extractAsIsIndicatorTypeId": "accountRep",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "useraccountcontrol": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "vendorid": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            },
            "vendorproduct": {
                "extractAsIsIndicatorTypeId": "",
                "extractIndicatorTypesIDs": [],
                "isExtractingAllIndicatorTypes": false
            }
        },
        "mode": "Specific"
    },
    "hours": 0,
    "hoursR": 0,
    "id": "Malware",
    "layout": "Malware Incident V2",
    "locked": false,
    "name": "Malware",
    "onChangeRepAlg": 0,
    "playbookId": "Endpoint Malware Investigation - Generic V2",
    "readonly": false,
    "reputationCalc": 0,
    "system": false,
    "version": -1,
    "weeks": 0,
    "weeksR": 0,
    "fromVersion": "6.1.0"
}