Cortex XDR Incident

ID	`Cortex XDR Incident`
Group	incident
Version	-1
From Version	6.8.0

Case info 15 sections

Case Details

Field ID	Position
type	Col 0-2, Height: 22
dbotsource	Col 0-2, Height: 22
sourceinstance	Col 0-2, Height: 22
sourcebrand	Col 0-2, Height: 22
severity	Col 0-2, Height: 22
owner	Col 0-2, Height: 22
playbookid	Col 0-2, Height: 22

Notes

Linked Incidents

Child Incidents

Evidence

Team Members

Timeline Information

Field ID	Position
dbotcreated	Col 0-2, Height: 24
occurred	Col 0-2, Height: 24
dbotmodified	Col 0-2, Height: 24
dbotclosed	Col 0-2, Height: 24
remediationsla	Col 0-2, Height: 24
detectionsla	Col 0-2, Height: 24
dbotduedate	Col 0-2, Height: 24

Closing Information

Field ID	Position
xdrresolvecomment	Col 0-2, Height: 22
dbotclosed	Col 0-2, Height: 22
closereason	Col 0-2, Height: 22
closinguserid	Col 0-2, Height: 22
closenotes	Col 0-2, Height: 44

XDR Basic Information

Field ID	Position
xdrdescription	Col 0-2, Height: 22
xdrincidentid	Col 0-2, Height: 22
xdrstatusv2	Col 0-2, Height: 22
description	Col 0-2, Height: 22
xdrmanualseverity	Col 0-2, Height: 22
xdrurl	Col 0-2, Height: 22
xdrnotes	Col 0-2, Height: 22
xdrassigneduserprettyname	Col 0-2, Height: 22
xdrassigneduseremail	Col 0-2, Height: 22
commandline	Col 0-2, Height: 22
commandlineverdict	Col 0-2, Height: 22

Related Alerts Severity

Affected Hosts Count

Affected Users Count

Mirroring Information

Field ID	Position
dbotmirrorid	Col 0-2, Height: 22
dbotmirrorinstance	Col 0-2, Height: 22
dbotmirrordirection	Col 0-2, Height: 22
dbotmirrorlastsync	Col 0-2, Height: 22
incomingmirrorerror	Col 0-2, Height: 44
outgoingmirrorerror	Col 0-2, Height: 44

Work Plan

Alert & Asset Count

Field ID	Position
xdrusercount	Col 0-2, Height: 22
xdrriskyusercount	Col 0-2, Height: 22
xdrhostcount	Col 0-2, Height: 22
xdrriskyhostcount	Col 0-2, Height: 22
xdralertcount	Col 0-2, Height: 22
xdrlowseverityalertcount	Col 0-2, Height: 22
xdrmediumseverityalertcount	Col 0-2, Height: 22
xdrhighseverityalertcount	Col 0-2, Height: 22

Investigation 6 sections

Incident Files

Indicators

XDR Alerts

Field ID	Position
xdralerts	Col 0-6, Height: 106

XDR File Artifacts

Field ID	Position
xdrfileartifacts	Col 0-6, Height: 110

XDR Network Artifacts

Field ID	Position
xdrnetworkartifacts	Col 0-6, Height: 106

XDR Endpoint Device Control Violations

Field ID	Position
xdrdevicecontrolviolations	Col 0-4, Height: 106

Risky Assets 2 sections

Risky Users

Displays users that are involved in the incident, and were deemed as risky by XDR's Identity Threat module, due to their time or nature of activities in various systems.

Field ID	Position
xdrriskyusers	Col 0-6, Height: 106

Risky Hosts

Displays hosts that are involved in the incident, and were deemed as risky by XDR's Identity Threat module, due to risky activities performed from or on them.

Field ID	Position
xdrriskyhosts	Col 0-6, Height: 106

Technical Details 7 sections

Attacker Extra Data

Field ID	Position
hostip	Col 0-2, Height: 22
sourceip	Col 0-2, Height: 22
useragent	Col 0-2, Height: 22
asnname	Col 0-2, Height: 22
asn	Col 0-2, Height: 22
country	Col 0-2, Height: 22

Malicious or Suspicious Indicators

Hunting Results

Cloud Indicators

The indicators extracted from the threat hunting results.

Cloud Info

Field ID	Position
projectid	Col 0-2, Height: 22
operationname	Col 0-2, Height: 22
operationtype	Col 0-2, Height: 22
identitytype	Col 0-2, Height: 22
region	Col 0-2, Height: 22
resourcetype	Col 0-2, Height: 22
referencedresourceid	Col 0-2, Height: 22
referencedresourcename	Col 0-2, Height: 22

Triage and Containment SLA

Field ID	Position
triagesla	Col 0-2, Height: 22
containmentsla	Col 0-2, Height: 22

Relationships

Field ID	Position
relatedcampaign	Col 0-2, Height: 22
relatedreport	Col 0-2, Height: 22
xdralertsearchresults	Col 0-4, Height: 106
mitretechniquename	Col 2-4, Height: 22

Identity Analytics 7 sections

Investigation Results

Field ID	Position
numberoffoundrelatedalerts	Col 0-2, Height: 53
failedlogonevents	Col 0-2, Height: 53
userrisklevel	Col 0-2, Height: 53

Verdict

FOUND RELATED ALERTS

Field ID	Position
xdralertsearchresults	Col 0-6, Height: 106

Response Actions

Field ID	Position
—	Col 0-2, Height: 44
—	Col 0-2, Height: 44
—	Col 0-2, Height: 44
—	Col 0-2, Height: 44

Identity Details

Field ID	Position
username	Col 0-2, Height: 26
accountstatus	Col 0-2, Height: 26
email	Col 0-2, Height: 26
accountmemberof	Col 0-2, Height: 26
cloudaccountid	Col 0-2, Height: 26
accountid	Col 0-2, Height: 26
manageremailaddress	Col 0-2, Height: 26

Connection Details

Field ID	Position
sourceip	Col 0-2, Height: 26
asn	Col 0-2, Height: 26
countrycode	Col 0-2, Height: 26
ipreputation	Col 0-2, Height: 26

Alert Details

Field ID	Position
alertname	Col 0-2, Height: 26
xdrdescription	Col 0-2, Height: 26
detecteduser	Col 0-2, Height: 26
detectedips	Col 0-2, Height: 26
occurred	Col 0-2, Height: 26
alerttags	Col 0-2, Height: 26

First SSO access 6 sections

Alert Details

Field ID	Position
alertname	Col 0-4, Height: 22
xdrdescription	Col 0-4, Height: 22
sourceip	Col 0-4, Height: 22
detecteduser	Col 0-4, Height: 22
occurred	Col 0-4, Height: 22

Account Information

Field ID	Position
samaccountname	Col 0-2, Height: 22
accountname	Col 0-2, Height: 22
employeeemail	Col 0-2, Height: 22
accountgroups	Col 0-2, Height: 22
managername	Col 0-2, Height: 22
manageremailaddress	Col 0-2, Height: 22

Connection Information

Field ID	Position
sourceip	Col 0-2, Height: 22
asn	Col 0-2, Height: 22
asnname	Col 0-2, Height: 22
countrycode	Col 0-2, Height: 22
countryname	Col 0-2, Height: 22
ipreputation	Col 0-2, Height: 22

Containment and Remediation status

Field ID	Position
userblockstatus	Col 0-2, Height: 22
containmentsla	Col 0-2, Height: 22
remediationsla	Col 0-2, Height: 22

Investigation Details

Field ID	Position
relatedreport	Col 0-4, Height: 22
partofcampaign	Col 0-4, Height: 22
xdralertsearchresults	Col 0-4, Height: 106

Verdict Results Parameters

Field ID	Position
verdict	Col 0-2, Height: 22
xdrinvestigationresults	Col 0-2, Height: 106

RDP Brute Force 4 sections

Alert Details

Field ID	Position
alertname	Col 0-2, Height: 22
xdrdescription	Col 0-2, Height: 22
sourceip	Col 0-2, Height: 22
asn	Col 0-2, Height: 22
detecteduser	Col 0-2, Height: 22
destinationhostname	Col 0-2, Height: 22
occurred	Col 0-2, Height: 22

Containment Status

Field ID	Position
userblockstatus	Col 0-2, Height: 53
ipblockedstatus	Col 0-2, Height: 53
endpointisolationstatus	Col 0-2, Height: 53
containmentsla	Col 2-4, Height: 53

Investigation Details

This section outlines the investigation steps, the results obtained, and the elements identified as suspicious.

Field ID	Position
ipreputation	Col 0-2, Height: 22
partofcampaign	Col 0-2, Height: 22
relatedreport	Col 0-2, Height: 22
huntresultscount	Col 0-2, Height: 22
sourcegeolocation	Col 0-2, Height: 22
userengagementresponse	Col 0-2, Height: 22
verdict	Col 0-2, Height: 22
xdralertsearchresults	Col 0-6, Height: 106
triagesla	Col 2-4, Height: 22
remediationsla	Col 2-4, Height: 22

Account Information

Field ID	Position
accountname	Col 0-2, Height: 22
employeeemail	Col 0-2, Height: 22
accountgroups	Col 0-2, Height: 22
managername	Col 0-2, Height: 22
manageremailaddress	Col 0-2, Height: 22
usercreationtime	Col 0-2, Height: 22
passwordchangeddate	Col 0-2, Height: 22

Large Upload 4 sections

Alert Details

Field ID	Position
alertname	Col 0-2, Height: 22
xdrdescription	Col 0-2, Height: 22
occurred	Col 0-2, Height: 22
hostname	Col 0-2, Height: 22
xdrusers	Col 0-2, Height: 22

Network Artifacts

Field ID	Position
xdrnetworkartifacts	Col 0-6, Height: 106

Investigation Details

Field ID	Position
verdict	Col 0-2, Height: 22
partofcampaign	Col 0-2, Height: 22
relatedreport	Col 0-2, Height: 22
commandline	Col 0-2, Height: 22
commandlineverdict	Col 0-2, Height: 22
threathuntingdetectedhostnames	Col 0-2, Height: 22
threathuntingdetectedip	Col 0-2, Height: 22

Containment and Remediation Status

Field ID	Position
containmentsla	Col 0-2, Height: 22
remediationsla	Col 0-2, Height: 22

Similar Incidents 1 section

XDR Similar Incidents

Field ID	Position
xdrsimilarincidents	Col 0-6, Height: 106

War Room 0 sections

No sections defined.

Work Plan 0 sections

No sections defined.

Evidence Board 0 sections

No sections defined.

Related Incidents 0 sections

No sections defined.

Canvas 0 sections

No sections defined.

Cortex XDR Incident

Details

Layout Structure

Case Details

Notes

Linked Incidents

Child Incidents

Evidence

Team Members

Timeline Information

Closing Information

XDR Basic Information

Related Alerts Severity

Affected Hosts Count

Affected Users Count

Mirroring Information

Work Plan

Alert & Asset Count

Incident Files

Indicators

XDR Alerts

XDR File Artifacts

XDR Network Artifacts

XDR Endpoint Device Control Violations

Risky Users

Risky Hosts

Attacker Extra Data

Malicious or Suspicious Indicators

Hunting Results

Cloud Indicators

Cloud Info

Triage and Containment SLA

Relationships

Investigation Results

Verdict

FOUND RELATED ALERTS

Response Actions

Identity Details

Connection Details

Alert Details

Alert Details

Account Information

Connection Information

Containment and Remediation status

Investigation Details

Verdict Results Parameters

Alert Details

Containment Status

Investigation Details

Account Information

Alert Details

Network Artifacts

Investigation Details

Containment and Remediation Status

XDR Similar Incidents