Cortex XDR - Lite
Cortex XDR by Palo Alto Networks Incident
Details
| ID | Cortex XDR - Lite |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.9.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Incident Info 7 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 22 |
| playbookid | Col 0-2, Height: 22 |
| dbotstatus | Col 0-2, Height: 22 |
| severity | Col 0-2, Height: 22 |
| description | Col 0-2, Height: 22 |
| owner | Col 0-2, Height: 22 |
| externallink | Col 0-2, Height: 22 |
| closereason | Col 0-2, Height: 22 |
| dbotsource | Col 0-2, Height: 22 |
| closenotes | Col 0-2, Height: 44 |
Work Plan
Timeline Information
| Field ID | Position |
|---|---|
| dbotcreated | Col 0-1, Height: 53 |
| occurred | Col 0-1, Height: 53 |
| dbotmodified | Col 1-2, Height: 53 |
| dbotclosed | Col 1-2, Height: 53 |
Response Actions
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
Entities Information
| Field ID | Position |
|---|---|
| devicename | Col 0-2, Height: 22 |
| devicestatus | Col 0-2, Height: 22 |
| deviceid | Col 0-2, Height: 22 |
| isolated | Col 0-2, Height: 22 |
| devicelocalip | Col 0-2, Height: 22 |
| devicemacaddress | Col 0-2, Height: 22 |
| deviceosname | Col 0-2, Height: 22 |
| deviceosversion | Col 0-2, Height: 22 |
| agentversion | Col 0-2, Height: 22 |
| accountname | Col 0-2, Height: 22 |
| Col 0-2, Height: 22 | |
| samaccountname | Col 0-2, Height: 22 |
| managername | Col 0-2, Height: 22 |
| accountmemberof | Col 0-2, Height: 22 |
Alerts In This Incident
| Field ID | Position |
|---|---|
| xdralerts | Col 0-4, Height: 106 |
Indicators Action
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
Investigation Results 4 sections
Indicators
All associated indicators with the current incident.
Investigation Results
| Field ID | Position |
|---|---|
| numberoffoundrelatedalerts | Col 0-2, Height: 53 |
| commandlineverdict | Col 0-2, Height: 53 |
| highriskyusers | Col 2-4, Height: 53 |
| highriskyhosts | Col 2-4, Height: 53 |
Found XDR Related Alerts
Additional Found XDR alerts by Mitre tactics related to the user and the endpoint.
| Field ID | Position |
|---|---|
| xdralertsearchresults | Col 0-6, Height: 106 |
Investigation Verdict
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.
{ "close": { "sections": [ { "description": "", "fields": [ { "fieldId": "incident_closereason", "isVisible": true }, { "fieldId": "incident_closenotes", "isVisible": true } ], "isVisible": true, "name": "Basic Information", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "isVisible": true, "name": "Custom Fields", "query": null, "queryType": "", "readOnly": false, "type": "" } ] }, "detailsV2": { "tabs": [ { "id": "summary", "name": "Legacy Summary", "type": "summary" }, { "id": "caseinfoid", "name": "Incident Info", "sections": [ { "displayType": "ROW", "h": 4, "i": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "isVisible": true, "items": [ { "dropEffect": "move", "endCol": 2, "fieldId": "type", "height": 22, "id": "incident-type-field", "index": 0, "listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "playbookid", "height": 22, "id": "incident-playbookId-field", "index": 1, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "dbotstatus", "height": 22, "id": "08a21b30-6cc6-11ee-9071-7966579ffb96", "index": 2, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "severity", "height": 22, "id": "incident-severity-field", "index": 3, "listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "description", "height": 22, "id": "7db0e920-c61d-11ec-a1fd-23d5100dabfb", "index": 4, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "owner", "height": 22, "id": "incident-owner-field", "index": 5, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "externallink", "height": 22, "id": "0dfa5930-c975-11ec-8d43-bd0d43281983", "index": 6, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "closereason", "height": 22, "id": "a1aed290-af31-11ec-9116-81cc45fec5cc", "index": 7, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "dbotsource", "height": 22, "id": "incident-source-field", "index": 8, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "closenotes", "height": 44, "id": "a3a21710-af31-11ec-9116-81cc45fec5cc", "index": 8, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Case Details", "static": false, "w": 1, "x": 0, "y": 0 }, { "displayType": "ROW", "h": 2, "i": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8", "maxW": 3, "minH": 1, "moved": false, "name": "Work Plan", "static": false, "type": "workplan", "w": 1, "x": 2, "y": 2 }, { "displayType": "CARD", "h": 2, "i": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", "items": [ { "dropEffect": "move", "endCol": 1, "fieldId": "dbotcreated", "height": 53, "id": "incident-created-field", "index": 0, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 1, "fieldId": "occurred", "height": 53, "id": "incident-occurred-field", "index": 1, "listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "dbotmodified", "height": 53, "id": "incident-modified-field", "index": 0, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", "sectionItemType": "field", "startCol": 1 }, { "dropEffect": "move", "endCol": 2, "fieldId": "dbotclosed", "height": 53, "id": "incident-closed-field", "index": 2, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", "sectionItemType": "field", "startCol": 1 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Timeline Information", "static": false, "w": 1, "x": 2, "y": 0 }, { "displayType": "ROW", "h": 3, "hideName": false, "i": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-dd17d3c0-c612-11ec-a1fd-23d5100dabfb", "items": [ { "args": { "action": { "simple": "isolate" } }, "buttonClass": "error", "endCol": 2, "fieldId": "", "height": 44, "id": "e8522010-c612-11ec-a1fd-23d5100dabfb", "index": 0, "name": "Isolate Endpoint", "scriptId": "IsolationAssetWrapper", "sectionItemType": "button", "startCol": 0 }, { "args": { "action": { "simple": "unisolate" } }, "buttonClass": "success", "endCol": 2, "fieldId": "", "height": 44, "id": "9bb79220-c613-11ec-a1fd-23d5100dabfb", "index": 1, "name": "Unisolate Endpoint", "scriptId": "IsolationAssetWrapper", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "error", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "id": "83367620-6cbc-11ee-8219-df92425018fa", "index": 2, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-dd17d3c0-c612-11ec-a1fd-23d5100dabfb", "name": "Add file to XDR Block List", "scriptId": "Cortex XDR - IR|||xdr-blocklist-files", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "success", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "id": "b7cab270-6cbc-11ee-8219-df92425018fa", "index": 3, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-dd17d3c0-c612-11ec-a1fd-23d5100dabfb", "name": "Remove file from XDR Block List", "scriptId": "Cortex XDR - IR|||xdr-remove-blocklist-files", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "warning", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "id": "d4bd95f0-6cbc-11ee-8219-df92425018fa", "index": 4, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-dd17d3c0-c612-11ec-a1fd-23d5100dabfb", "name": "Quarantine File", "scriptId": "Cortex XDR - IR|||xdr-file-quarantine", "sectionItemType": "button", "startCol": 0 }, { "args": { "approve_action": { "simple": "", "userMarkedRequired": true } }, "buttonClass": "error", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "id": "c23869f0-38b0-11ed-afe1-49eafc90e024", "index": 5, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-dd17d3c0-c612-11ec-a1fd-23d5100dabfb", "name": "Disable Account", "scriptId": "DisableUserWrapper", "sectionItemType": "button", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Response Actions", "static": false, "w": 1, "x": 2, "y": 4 }, { "displayType": "ROW", "h": 4, "hideName": false, "i": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "items": [ { "dropEffect": "move", "endCol": 2, "fieldId": "devicename", "height": 22, "id": "8b18f110-cd53-11ec-b8d3-473c44a255a1", "index": 0, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "devicestatus", "height": 22, "id": "f5954fc0-283e-11ed-8c97-f9dd7dd886c9", "index": 1, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "deviceid", "height": 22, "id": "eb69c510-6cd7-11ee-9071-7966579ffb96", "index": 2, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "isolated", "height": 22, "id": "553a75a0-cec0-11ec-a53f-afaf974101db", "index": 3, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "devicelocalip", "height": 22, "id": "9fe976a0-cd53-11ec-b8d3-473c44a255a1", "index": 4, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "devicemacaddress", "height": 22, "id": "c55f3370-c975-11ec-8d43-bd0d43281983", "index": 5, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "deviceosname", "height": 22, "id": "b99eee40-c975-11ec-8d43-bd0d43281983", "index": 6, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "deviceosversion", "height": 22, "id": "55570390-283f-11ed-8c97-f9dd7dd886c9", "index": 7, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "agentversion", "height": 22, "id": "c9875950-c975-11ec-8d43-bd0d43281983", "index": 8, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "accountname", "height": 22, "id": "4f03b730-22d7-11ed-bcfa-ed0fc7bbe55c", "index": 9, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "email", "height": 22, "id": "5a2c9010-6bfa-11ee-9d91-815f3fec4269", "index": 10, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-3477c190-22d7-11ed-bcfa-ed0fc7bbe55c", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "samaccountname", "height": 22, "id": "50e45e10-22d7-11ed-bcfa-ed0fc7bbe55c", "index": 11, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "managername", "height": 22, "id": "755de400-6cd7-11ee-9071-7966579ffb96", "index": 12, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "accountmemberof", "height": 22, "id": "9af619f0-2465-11ed-b0d1-d104a399cfaa", "index": 13, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-6af94380-c975-11ec-8d43-bd0d43281983", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Entities Information", "static": false, "w": 1, "x": 1, "y": 0 }, { "columns": [ { "displayName": "Alert Id", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "alertid", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Detection Timestamp", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "detectiontimestamp", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Severity", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "severity", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Name", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "name", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Category", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "category", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Action", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "action", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Action Pretty", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "actionpretty", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Description", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "description", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Host IP", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "hostip", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "Host Name", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "hostname", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "User Name", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "username", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "MITRE ATTACK TACTIC", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "mitretacticidandname", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "MITRE ATTACK TECHNIQUE", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "mitretechniqueidandname", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 } ], "displayType": "ROW", "h": 5, "hideItemTitleOnlyOne": false, "hideName": false, "i": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-3477c190-22d7-11ed-bcfa-ed0fc7bbe55c", "items": [ { "endCol": 4, "fieldId": "xdralerts", "height": 106, "id": "3ee01850-70d6-11ee-9bb8-f3bb16f4a89c", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Alerts In This Incident", "static": false, "w": 2, "x": 0, "y": 4 }, { "displayType": "ROW", "h": 2, "hideName": false, "i": "caseinfoid-2169c430-6cc9-11ee-9071-7966579ffb96", "items": [ { "args": {}, "buttonClass": "error", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "id": "e8848bc0-c975-11ec-8d43-bd0d43281983", "index": 0, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-dd17d3c0-c612-11ec-a1fd-23d5100dabfb", "name": "Tag Indicator For Deny List", "scriptId": "AppendindicatorFieldWrapper", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "success", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "id": "e9dc2c80-c975-11ec-8d43-bd0d43281983", "index": 1, "listId": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-dd17d3c0-c612-11ec-a1fd-23d5100dabfb", "name": "Tag Indicator For Allow List", "scriptId": "AppendindicatorFieldWrapper", "sectionItemType": "button", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Indicators Action", "static": false, "w": 1, "x": 2, "y": 7 } ], "type": "custom" }, { "hidden": false, "id": "geft1rmudr", "name": "Investigation Results", "sections": [ { "description": "All associated indicators with the current incident.", "h": 3, "i": "caseinfoid-fsn6exn0fu-geft1rmudr-caseinfoid-73e465f0-c6d3-11ec-a8a7-e939c3eb5596", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Indicators", "query": "", "queryType": "input", "static": false, "type": "indicators", "w": 3, "x": 0, "y": 5 }, { "displayType": "CARD", "h": 2, "hideName": false, "i": "caseinfoid-e59a5480-6e5b-11ee-bb7d-5f7d74b63139", "items": [ { "dropEffect": "move", "endCol": 2, "fieldId": "numberoffoundrelatedalerts", "height": 53, "id": "bab3fe80-70d4-11ee-a30f-1733aea2bc2f", "index": 0, "listId": "caseinfoid-e59a5480-6e5b-11ee-bb7d-5f7d74b63139", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "commandlineverdict", "height": 53, "id": "c243a340-6e6c-11ee-b265-337c8614e7d2", "index": 1, "listId": "caseinfoid-e59a5480-6e5b-11ee-bb7d-5f7d74b63139", "sectionItemType": "field", "startCol": 0 }, { "endCol": 4, "fieldId": "highriskyusers", "height": 53, "id": "741355f0-6e74-11ee-b265-337c8614e7d2", "index": 0, "sectionItemType": "field", "startCol": 2 }, { "dropEffect": "move", "endCol": 4, "fieldId": "highriskyhosts", "height": 53, "id": "71e94a00-6e74-11ee-b265-337c8614e7d2", "index": 2, "listId": "caseinfoid-e59a5480-6e5b-11ee-bb7d-5f7d74b63139", "sectionItemType": "field", "startCol": 2 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Investigation Results", "static": false, "w": 2, "x": 1, "y": 0 }, { "columns": [ { "displayName": "alert_name", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "alert_name", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 417 }, { "displayName": "alert_category", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "alert_category", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 259 }, { "displayName": "alert_description_raw", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "alert_description_raw", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 757 }, { "displayName": "agent_hostname", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "agent_hostname", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 163 }, { "displayName": "actor_effective_username", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "actor_effective_username", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 402 }, { "displayName": "action_process_image_path", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "action_process_image_path", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 208 }, { "displayName": "action_process_image_command_line", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "action_process_image_command_line", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 262 }, { "displayName": "severity", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "severity", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "alert_action_status", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "alert_action_status", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 }, { "displayName": "internal_id", "fieldCalcScript": "", "isDefault": true, "isReadOnly": false, "key": "internal_id", "orgType": "shortText", "required": false, "script": "", "selectValues": null, "type": "shortText", "width": 150 } ], "description": "Additional Found XDR alerts by Mitre tactics related to the user and the endpoint.", "displayType": "ROW", "h": 3, "hideItemTitleOnlyOne": true, "hideName": false, "i": "caseinfoid-2f72d710-6e6d-11ee-b265-337c8614e7d2", "items": [ { "endCol": 6, "fieldId": "xdralertsearchresults", "height": 106, "id": "3b1a6420-6e6d-11ee-b265-337c8614e7d2", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Found XDR Related Alerts", "static": false, "w": 3, "x": 0, "y": 2 }, { "h": 2, "i": "caseinfoid-d4b757a0-70de-11ee-b080-935915492bc0", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Investigation Verdict", "query": "CortexXDRInvestigationVerdict", "queryType": "script", "static": false, "type": "dynamic", "w": 1, "x": 0, "y": 0 } ], "type": "custom" }, { "id": "warRoom", "name": "War Room", "type": "warRoom" }, { "id": "workPlan", "name": "Work Plan", "type": "workPlan" }, { "id": "evidenceBoard", "name": "Evidence Board", "type": "evidenceBoard" }, { "id": "relatedIncidents", "name": "Related Incidents", "type": "relatedIncidents" }, { "id": "canvas", "name": "Canvas", "type": "canvas" } ] }, "edit": { "sections": [ { "description": "", "fields": [ { "fieldId": "incident_name", "isVisible": true }, { "fieldId": "incident_occurred", "isVisible": true }, { "fieldId": "incident_reminder", "isVisible": true }, { "fieldId": "incident_owner", "isVisible": true }, { "fieldId": "incident_roles", "isVisible": true }, { "fieldId": "incident_type", "isVisible": true }, { "fieldId": "incident_severity", "isVisible": true }, { "fieldId": "incident_playbookid", "isVisible": true }, { "fieldId": "incident_labels", "isVisible": true }, { "fieldId": "incident_phase", "isVisible": true }, { "fieldId": "incident_details", "isVisible": true }, { "fieldId": "incident_attachment", "isVisible": true } ], "isVisible": true, "name": "Basic Information", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_filename", "isVisible": true }, { "fieldId": "incident_filepath", "isVisible": true }, { "fieldId": "incident_filehash", "isVisible": true } ], "isVisible": true, "name": "Malware File", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_signature", "isVisible": true }, { "fieldId": "incident_malwarefamily", "isVisible": true }, { "fieldId": "incident_src", "isVisible": true } ], "isVisible": true, "name": "Malware Info", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_vendorproduct", "isVisible": true }, { "fieldId": "incident_dest", "isVisible": true }, { "fieldId": "incident_destntdomain", "isVisible": true } ], "isVisible": true, "name": "System Affected", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "isVisible": true, "name": "Custom Fields", "query": null, "queryType": "", "readOnly": false, "type": "" } ] }, "group": "incident", "id": "Cortex XDR - Lite", "name": "Cortex XDR - Lite", "quickView": { "sections": [ { "description": "", "fields": [ { "fieldId": "incident_type", "isVisible": true }, { "fieldId": "incident_severity", "isVisible": true }, { "fieldId": "incident_owner", "isVisible": true }, { "fieldId": "incident_dbotstatus", "isVisible": true }, { "fieldId": "incident_sourcebrand", "isVisible": true }, { "fieldId": "incident_sourceinstance", "isVisible": true }, { "fieldId": "incident_playbookid", "isVisible": true }, { "fieldId": "incident_phase", "isVisible": true }, { "fieldId": "incident_roles", "isVisible": true } ], "isVisible": true, "name": "Basic Information", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_occurred", "isVisible": true }, { "fieldId": "incident_dbotcreated", "isVisible": true }, { "fieldId": "incident_dbotduedate", "isVisible": true }, { "fieldId": "incident_dbotmodified", "isVisible": true }, { "fieldId": "incident_dbottotaltime", "isVisible": true } ], "isVisible": true, "name": "Timeline Information", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_agentid", "isVisible": true }, { "fieldId": "incident_alertid", "isVisible": true }, { "fieldId": "incident_alertname", "isVisible": true }, { "fieldId": "incident_app", "isVisible": true }, { "fieldId": "incident_appchannelname", "isVisible": true }, { "fieldId": "incident_appmessage", "isVisible": true }, { "fieldId": "incident_assigneduser", "isVisible": true }, { "fieldId": "incident_assignmentgroup", "isVisible": true }, { "fieldId": "incident_caller", "isVisible": true }, { "fieldId": "incident_commandline", "isVisible": true }, { "fieldId": "incident_country", "isVisible": true }, { "fieldId": "incident_destinationhostname", "isVisible": true }, { "fieldId": "incident_destinationip", "isVisible": true }, { "fieldId": "incident_destinationnetwork", "isVisible": true }, { "fieldId": "incident_destinationport", "isVisible": true }, { "fieldId": "incident_detectionsla", "isVisible": true }, { "fieldId": "incident_detectionurl", "isVisible": true }, { "fieldId": "incident_deviceexternalip", "isVisible": true }, { "fieldId": "incident_devicehash", "isVisible": true }, { "fieldId": "incident_deviceid", "isVisible": true }, { "fieldId": "incident_devicelocalip", "isVisible": true }, { "fieldId": "incident_devicemodel", "isVisible": true }, { "fieldId": "incident_devicename", "isVisible": true }, { "fieldId": "incident_escalation", "isVisible": true }, { "fieldId": "incident_eventid", "isVisible": true }, { "fieldId": "incident_eventtype", "isVisible": true }, { "fieldId": "incident_filehash", "isVisible": true }, { "fieldId": "incident_filename", "isVisible": true }, { "fieldId": "incident_filepath", "isVisible": true }, { "fieldId": "incident_filesize", "isVisible": true }, { "fieldId": "incident_firstname", "isVisible": true }, { "fieldId": "incident_incomingmirrorerror", "isVisible": true }, { "fieldId": "incident_investigationstage", "isVisible": true }, { "fieldId": "incident_lastname", "isVisible": true }, { "fieldId": "incident_logsource", "isVisible": true }, { "fieldId": "incident_lowlevelcategoriesevents", "isVisible": true }, { "fieldId": "incident_macaddress", "isVisible": true }, { "fieldId": "incident_md5", "isVisible": true }, { "fieldId": "incident_mobiledevicemodel", "isVisible": true }, { "fieldId": "incident_os", "isVisible": true }, { "fieldId": "incident_osversion", "isVisible": true }, { "fieldId": "incident_outgoingmirrorerror", "isVisible": true }, { "fieldId": "incident_phonenumber", "isVisible": true }, { "fieldId": "incident_pid", "isVisible": true }, { "fieldId": "incident_protocol", "isVisible": true }, { "fieldId": "incident_remediationsla", "isVisible": true }, { "fieldId": "incident_sha1", "isVisible": true }, { "fieldId": "incident_sha256", "isVisible": true }, { "fieldId": "incident_sha512", "isVisible": true }, { "fieldId": "incident_similarincidents", "isVisible": true }, { "fieldId": "incident_sourcehostname", "isVisible": true }, { "fieldId": "incident_sourceip", "isVisible": true }, { "fieldId": "incident_sourcenetwork", "isVisible": true }, { "fieldId": "incident_sourceport", "isVisible": true }, { "fieldId": "incident_sourceusername", "isVisible": true }, { "fieldId": "incident_state", "isVisible": true }, { "fieldId": "incident_subcategory", "isVisible": true }, { "fieldId": "incident_teamname", "isVisible": true }, { "fieldId": "incident_tenantname", "isVisible": true }, { "fieldId": "incident_ticketacknowledgeddate", "isVisible": true }, { "fieldId": "incident_ticketcloseddate", "isVisible": true }, { "fieldId": "incident_ticketnumber", "isVisible": true }, { "fieldId": "incident_ticketopeneddate", "isVisible": true }, { "fieldId": "incident_timetoassignment", "isVisible": true }, { "fieldId": "incident_urlsslverification", "isVisible": true }, { "fieldId": "incident_useraccountcontrol", "isVisible": true } ], "isVisible": true, "name": "Custom Fields", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_labels", "isVisible": true } ], "isVisible": true, "name": "Labels", "query": null, "queryType": "", "readOnly": true, "type": "labels" } ] }, "system": false, "version": -1, "fromVersion": "6.9.0", "description": "" }