{
"detailsV2": {
"tabs": [
{
"hidden": false,
"id": "1vduzkpmlh",
"name": "Case info",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "type",
"height": 22,
"id": "1cc0c4a0-9bd7-11e9-ba23-8723b1f1df6b",
"index": 0,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "dbotsource",
"height": 22,
"id": "87e18ad0-9bd7-11e9-ba23-8723b1f1df6b",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceinstance",
"height": 22,
"id": "43cfe2d0-9bee-11e9-9a3f-8b4b2158e260",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sourcebrand",
"height": 22,
"id": "42f03130-9bee-11e9-9a3f-8b4b2158e260",
"index": 2,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "severity",
"height": 22,
"id": "20430d90-9bd7-11e9-ba23-8723b1f1df6b",
"index": 3,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "owner",
"height": 22,
"id": "4fd2b640-a7d6-11e9-8433-9f52f2917950",
"index": 4,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "playbookid",
"height": 22,
"id": "930bb7a0-a866-11e9-aeb8-c3448b5d692d",
"index": 5,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Case Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Notes",
"readOnly": true,
"static": false,
"type": "notes",
"w": 1,
"x": 2,
"y": 4
},
{
"columns": [
{
"displayed": true,
"isDefault": false,
"key": "id",
"width": 110
},
{
"displayed": true,
"isDefault": true,
"key": "name",
"width": 300
},
{
"displayed": true,
"isDefault": false,
"key": "owner",
"width": 160
},
{
"displayed": true,
"isDefault": true,
"key": "type",
"width": 200
},
{
"displayed": true,
"isDefault": true,
"key": "status",
"width": 80
},
{
"displayed": true,
"isDefault": true,
"key": "closeNotes",
"width": 300
}
],
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-770ec200-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Linked Incidents",
"readOnly": true,
"static": false,
"type": "linkedIncidents",
"w": 1,
"x": 2,
"y": 6
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-842632c0-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Child Incidents",
"readOnly": true,
"static": false,
"type": "childInv",
"w": 1,
"x": 2,
"y": 8
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-4a31afa0-98ba-11e9-a519-93a53c759fe0",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Evidence",
"readOnly": true,
"static": false,
"type": "evidence",
"w": 1,
"x": 1,
"y": 8
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-7717e580-9bed-11e9-9a3f-8b4b2158e260",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Team Members",
"readOnly": true,
"static": false,
"type": "team",
"w": 1,
"x": 1,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"isVisible": true,
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotcreated",
"height": 24,
"id": "930bf0a0-a864-11e9-aeb8-c3448b5d692d",
"index": 0,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "occurred",
"height": 24,
"id": "e92b52b0-a863-11e9-aeb8-c3448b5d692d",
"index": 1,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "dbotmodified",
"height": 24,
"id": "99cbd860-a864-11e9-aeb8-c3448b5d692d",
"index": 2,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotclosed",
"height": 24,
"id": "a1a67ef0-a864-11e9-aeb8-c3448b5d692d",
"index": 3,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "remediationsla",
"height": 24,
"id": "6cd9de10-9bee-11e9-9a3f-8b4b2158e260",
"index": 4,
"listId": "24257a20-98b1-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "detectionsla",
"height": 24,
"id": "6b72acf0-9bee-11e9-9a3f-8b4b2158e260",
"index": 5,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotduedate",
"height": 24,
"id": "551d6320-a7d6-11e9-8433-9f52f2917950",
"index": 6,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Timeline Information",
"static": false,
"w": 1,
"x": 0,
"y": 6
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-e462ffc0-a864-11e9-aeb8-c3448b5d692d",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "xdrresolvecomment",
"height": 22,
"id": "5a450d90-ac8a-11e9-a30b-53d47e1ea7d7",
"index": 0,
"startCol": 0,
"sectionItemType": "field"
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotclosed",
"height": 22,
"id": "427bf020-a866-11e9-aeb8-c3448b5d692d",
"index": 1,
"listId": "e462ffc0-a864-11e9-aeb8-c3448b5d692d",
"startCol": 0,
"sectionItemType": "field"
},
{
"endCol": 2,
"fieldId": "closereason",
"height": 22,
"id": "f23f6e30-a864-11e9-aeb8-c3448b5d692d",
"index": 2,
"startCol": 0,
"sectionItemType": "field"
},
{
"endCol": 2,
"fieldId": "closinguserid",
"height": 22,
"id": "f387a5a0-a864-11e9-aeb8-c3448b5d692d",
"index": 3,
"startCol": 0,
"sectionItemType": "field"
},
{
"endCol": 2,
"fieldId": "closenotes",
"height": 44,
"id": "f579ffc0-a864-11e9-aeb8-c3448b5d692d",
"index": 4,
"startCol": 0,
"sectionItemType": "field"
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Closing Information",
"static": false,
"w": 1,
"x": 0,
"y": 8
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdrdescription",
"height": 22,
"id": "a398d4f0-ac89-11e9-a30b-53d47e1ea7d7",
"index": 0,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrincidentid",
"height": 22,
"id": "3ebb4a40-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrstatusv2",
"height": 22,
"id": "4f80f5f0-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "description",
"height": 22,
"id": "4b1ead40-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrmanualseverity",
"height": 22,
"id": "c40c7ac0-ac89-11e9-a30b-53d47e1ea7d7",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrurl",
"height": 22,
"id": "df4e1380-aef4-11e9-896e-b72bc9d2cace",
"index": 5,
"sectionItemType": "field",
"startCol": 0,
"dropEffect": "move",
"listId": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-d8316060-ac70-11e9-a30b-53d47e1ea7d7"
},
{
"endCol": 2,
"fieldId": "xdrnotes",
"height": 22,
"id": "8f040360-ac8a-11e9-a30b-53d47e1ea7d7",
"index": 6,
"listId": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdrassigneduserprettyname",
"height": 22,
"id": "688064a0-ad29-11e9-b20c-1b6878c52e9c",
"index": 7,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdrassigneduseremail",
"height": 22,
"id": "3704da40-ac8a-11e9-a30b-53d47e1ea7d7",
"index": 8,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "commandline",
"height": 22,
"id": "08605a40-93b5-11ee-9cb4-d1e11cb88c56",
"index": 9,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "commandlineverdict",
"height": 22,
"id": "0ef07f70-93b5-11ee-9cb4-d1e11cb88c56",
"index": 10,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "XDR Basic Information",
"static": false,
"w": 1,
"x": 1,
"y": 0
},
{
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-6f1661f0-ad44-11e9-a569-716c95c51bfe",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Related Alerts Severity",
"query": "EntryWidgetPieAlertsXDR",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 0,
"y": 2
},
{
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-5cc7f260-ad4f-11e9-a2d3-c520aeb407da",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Affected Hosts Count",
"query": "EntryWidgetNumberHostsXDR",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 1,
"y": 2
},
{
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-11cd1fd0-ad52-11e9-a2d3-c520aeb407da",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Affected Users Count",
"query": "EntryWidgetNumberUsersXDR",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 2,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-27575a40-dbd3-11ea-816e-f14862061e21",
"items": [
{
"endCol": 2,
"fieldId": "dbotmirrorid",
"height": 22,
"id": "617e48f0-dbd3-11ea-816e-f14862061e21",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "dbotmirrorinstance",
"height": 22,
"id": "675fb790-dbd3-11ea-816e-f14862061e21",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotmirrordirection",
"height": 22,
"id": "63fa6c80-dbd3-11ea-816e-f14862061e21",
"index": 2,
"listId": "1vduzkpmlh-27575a40-dbd3-11ea-816e-f14862061e21",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "dbotmirrorlastsync",
"height": 22,
"id": "6b9cec10-dbd3-11ea-816e-f14862061e21",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "incomingmirrorerror",
"height": 44,
"id": "04fd6b70-dbd7-11ea-816e-f14862061e21",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "outgoingmirrorerror",
"height": 44,
"id": "079f1860-dbd7-11ea-816e-f14862061e21",
"index": 5,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Mirroring Information",
"static": false,
"w": 1,
"x": 1,
"y": 6
},
{
"h": 2,
"i": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-c037a9b0-5412-11eb-830f-fbfa6e45cb4e",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Work Plan",
"static": false,
"type": "workplan",
"w": 1,
"x": 0,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-f5ec1810-61cb-11ee-8258-1b5d9765392a",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdrusercount",
"height": 22,
"id": "b1232bc0-ac89-11e9-a30b-53d47e1ea7d7",
"index": 0,
"listId": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdrriskyusercount",
"height": 22,
"id": "b965df60-401b-11ee-bc50-a9a9295a889b",
"index": 1,
"listId": "1vduzkpmlh-lthdv5gwt9-1vduzkpmlh-d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrhostcount",
"height": 22,
"id": "5d54d8e0-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrriskyhostcount",
"height": 22,
"id": "8e7d8a20-40be-11ee-9b52-09ff9fac4941",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdralertcount",
"height": 22,
"id": "53bb4440-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 4,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrlowseverityalertcount",
"height": 22,
"id": "440ae3b0-ac7b-11e9-a30b-53d47e1ea7d7",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdrmediumseverityalertcount",
"height": 22,
"id": "42b2a6b0-ac7b-11e9-a30b-53d47e1ea7d7",
"index": 6,
"listId": "1vduzkpmlh-f5ec1810-61cb-11ee-8258-1b5d9765392a",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrhighseverityalertcount",
"height": 22,
"id": "407735a0-ac7b-11e9-a30b-53d47e1ea7d7",
"index": 7,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Alert \u0026 Asset Count",
"static": false,
"w": 1,
"x": 2,
"y": 0
}
],
"type": "custom"
},
{
"filters": [
[
{
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "xdralertname"
}
},
"operator": "notContainsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "token"
}
},
"type": "multiSelect"
}
]
],
"hidden": false,
"id": "swtuqptgvs",
"name": "Investigation",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-swtuqptgvs-067d4900-98b4-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Incident Files",
"query": {
"categories": [
"attachments"
],
"lastId": "",
"pageSize": 100,
"tags": [],
"users": []
},
"queryType": "warRoomFilter",
"readOnly": true,
"static": false,
"type": "invTimeline",
"w": 1,
"x": 2,
"y": 9
},
{
"displayType": "ROW",
"h": 4,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-swtuqptgvs-cc557320-98b7-11e9-b34a-852d068f44fe",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Indicators",
"query": "",
"queryType": "input",
"readOnly": true,
"static": false,
"type": "indicators",
"w": 2,
"x": 0,
"y": 11
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-swtuqptgvs-075ee440-cc9a-11e9-afca-8792f3871db0",
"items": [
{
"dropEffect": "move",
"endCol": 6,
"fieldId": "xdralerts",
"height": 106,
"id": "1b6eb1e0-cc9a-11e9-afca-8792f3871db0",
"index": 0,
"listId": "swtuqptgvs-075ee440-cc9a-11e9-afca-8792f3871db0",
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "XDR Alerts",
"static": false,
"w": 3,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-swtuqptgvs-2ff499e0-cc9a-11e9-afca-8792f3871db0",
"items": [
{
"endCol": 6,
"fieldId": "xdrfileartifacts",
"height": 110,
"id": "447eeeb0-cc9a-11e9-afca-8792f3871db0",
"index": 0,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "XDR File Artifacts",
"static": false,
"w": 3,
"x": 0,
"y": 3
},
{
"displayType": "ROW",
"h": 3,
"hideItemTitleOnlyOne": false,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-swtuqptgvs-3604e0b0-cc9a-11e9-afca-8792f3871db0",
"items": [
{
"endCol": 6,
"fieldId": "xdrnetworkartifacts",
"height": 106,
"id": "498825c0-cc9a-11e9-afca-8792f3871db0",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "XDR Network Artifacts",
"static": false,
"w": 3,
"x": 0,
"y": 6
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-lthdv5gwt9-swtuqptgvs-4309fd80-453a-11eb-bfbf-0d0f7ea2cc09",
"items": [
{
"endCol": 4,
"fieldId": "xdrdevicecontrolviolations",
"height": 106,
"id": "67898ea0-453a-11eb-bfbf-0d0f7ea2cc09",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "XDR Endpoint Device Control Violations",
"static": false,
"w": 2,
"x": 0,
"y": 9
}
],
"type": "custom"
},
{
"filters": [
[
{
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "xdrriskyhostcount"
}
},
"operator": "greaterThan",
"right": {
"isContext": false,
"value": {
"simple": "0"
}
},
"type": "number"
},
{
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "xdrriskyusercount"
}
},
"operator": "greaterThan",
"right": {
"isContext": false,
"value": {
"simple": "0"
}
},
"type": "number"
}
]
],
"hidden": false,
"id": "qevuzu2oip",
"name": "Risky Assets",
"sections": [
{
"description": "Displays users that are involved in the incident, and were deemed as risky by XDR's Identity Threat module, due to their time or nature of activities in various systems.",
"displayType": "ROW",
"h": 3,
"hideItemTitleOnlyOne": true,
"hideName": false,
"i": "1vduzkpmlh-de41cda0-47f8-11ee-98f3-e53ed2b50bbd",
"items": [
{
"endCol": 6,
"fieldId": "xdrriskyusers",
"height": 106,
"id": "439d86d0-47f9-11ee-98f3-e53ed2b50bbd",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Risky Users",
"static": false,
"w": 3,
"x": 0,
"y": 0
},
{
"description": "Displays hosts that are involved in the incident, and were deemed as risky by XDR's Identity Threat module, due to risky activities performed from or on them.",
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "1vduzkpmlh-df5400f0-47f8-11ee-98f3-e53ed2b50bbd",
"items": [
{
"endCol": 6,
"fieldId": "xdrriskyhosts",
"height": 106,
"id": "46b945c0-47f9-11ee-98f3-e53ed2b50bbd",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Risky Hosts",
"static": false,
"w": 3,
"x": 0,
"y": 3
}
],
"type": "custom"
},
{
"filters": [
[
{
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "xdralertname"
}
},
"operator": "containsString",
"right": {
"isContext": false,
"value": {
"simple": "token"
}
},
"type": "multiSelect"
}
]
],
"hidden": false,
"id": "tml1wrkxme",
"name": "Technical Details",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-ohwq8lhsex-caseinfoid-be53e110-3992-11ed-9adb-83e728f46893",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "hostip",
"height": 22,
"id": "aeeee620-ffbc-11ed-91cb-b704c053731a",
"index": 0,
"listId": "caseinfoid-be53e110-3992-11ed-9adb-83e728f46893",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceip",
"height": 22,
"id": "6c27dc10-1507-11ee-afe1-4bea2a14f94c",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "useragent",
"height": 22,
"id": "cbf13710-18e3-11ee-a005-5968c8362785",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "asnname",
"height": 22,
"id": "7bbf2660-ffbd-11ed-91cb-b704c053731a",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "asn",
"height": 22,
"id": "74d9fc50-3fef-11ed-bd56-1f5a2b2d17b4",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "country",
"height": 22,
"id": "4c8d5610-0f52-11ee-81b3-5b1a51073e91",
"index": 4,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Attacker Extra Data",
"static": false,
"w": 1,
"x": 1,
"y": 0
},
{
"h": 3,
"i": "1vduzkpmlh-ohwq8lhsex-caseinfoid-944f47f0-3fce-11ed-81fb-f98f11f06b6f",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Malicious or Suspicious Indicators",
"static": false,
"w": 2,
"x": 0,
"y": 2,
"query": "reputation:Benign OR reputation:Suspicious OR reputation:Malicious",
"queryType": "input",
"type": "indicators"
},
{
"h": 2,
"i": "1vduzkpmlh-ohwq8lhsex-caseinfoid-738a28d0-ffd3-11ed-94b9-ab17767bb4e7",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Hunting Results",
"static": false,
"w": 1,
"x": 2,
"y": 5,
"query": {
"categories": [
"tags"
],
"preDefinedFilters": true,
"tags": [
"PersistenceHunting"
]
},
"queryType": "warRoomFilter",
"type": "invTimeline"
},
{
"h": 3,
"i": "1vduzkpmlh-ohwq8lhsex-caseinfoid-494706a0-063c-11ee-b283-eb5063f641e1",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Cloud Indicators",
"static": false,
"w": 1,
"x": 2,
"y": 2,
"description": "The indicators extracted from the threat hunting results.",
"query": "displayCloudIndicators",
"queryType": "script",
"type": "dynamic"
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-d9090e20-158f-11ee-9c72-eb2e3cb3cb42",
"items": [
{
"endCol": 2,
"fieldId": "projectid",
"height": 22,
"id": "e94dca00-158f-11ee-9c72-eb2e3cb3cb42",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "operationname",
"height": 22,
"id": "f7b7d270-158f-11ee-9c72-eb2e3cb3cb42",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "operationtype",
"height": 22,
"id": "f8abcf60-158f-11ee-9c72-eb2e3cb3cb42",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "identitytype",
"height": 22,
"id": "fc49ddb0-158f-11ee-9c72-eb2e3cb3cb42",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "region",
"height": 22,
"id": "6204ffb0-15b6-11ee-9c72-eb2e3cb3cb42",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "resourcetype",
"height": 22,
"id": "69d67e80-15b6-11ee-9c72-eb2e3cb3cb42",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "referencedresourceid",
"height": 22,
"id": "a6834e20-18be-11ee-a005-5968c8362785",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "referencedresourcename",
"height": 22,
"id": "a7935e90-18be-11ee-a005-5968c8362785",
"index": 7,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Cloud Info",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-a800cd00-15b6-11ee-9c72-eb2e3cb3cb42",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "triagesla",
"height": 22,
"id": "b474aac0-15b6-11ee-9c72-eb2e3cb3cb42",
"index": 0,
"listId": "1vduzkpmlh-a800cd00-15b6-11ee-9c72-eb2e3cb3cb42",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "containmentsla",
"height": 22,
"id": "b30aba80-15b6-11ee-9c72-eb2e3cb3cb42",
"index": 1,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Triage and Containment SLA",
"static": false,
"w": 1,
"x": 2,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-ff06e9b0-1672-11ee-9c72-eb2e3cb3cb42",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "relatedcampaign",
"height": 22,
"id": "a349d8c0-1673-11ee-9c72-eb2e3cb3cb42",
"index": 0,
"listId": "1vduzkpmlh-ff06e9b0-1672-11ee-9c72-eb2e3cb3cb42",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "relatedreport",
"height": 22,
"id": "a60c7b30-1673-11ee-9c72-eb2e3cb3cb42",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 4,
"fieldId": "xdralertsearchresults",
"height": 106,
"id": "83a31520-18be-11ee-a005-5968c8362785",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "mitretechniquename",
"height": 22,
"id": "5809fe30-1687-11ee-9c72-eb2e3cb3cb42",
"index": 0,
"listId": "1vduzkpmlh-ff06e9b0-1672-11ee-9c72-eb2e3cb3cb42",
"sectionItemType": "field",
"startCol": 2
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Relationships",
"static": false,
"w": 2,
"x": 0,
"y": 5
}
],
"type": "custom"
},
{
"filters": [
[
{
"id": 0,
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "alerttags"
}
},
"operator": "containsString",
"right": {
"isContext": false,
"value": {
"simple": "DT:Identity Analytics"
}
},
"type": "shortText"
}
]
],
"hidden": false,
"id": "wmtowidpmp",
"name": "Identity Analytics",
"sections": [
{
"displayType": "CARD",
"h": 2,
"hideName": false,
"i": "wmtowidpmp-bf27ef60-bdc0-11ee-a451-7b39f6b1cb95",
"items": [
{
"endCol": 2,
"fieldId": "numberoffoundrelatedalerts",
"height": 53,
"id": "12f10ff0-bdc1-11ee-a451-7b39f6b1cb95",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "failedlogonevents",
"height": 53,
"id": "18745900-bdc1-11ee-a451-7b39f6b1cb95",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "userrisklevel",
"height": 53,
"id": "3d79a2a0-bdc6-11ee-81b8-1dd092d8ebaf",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxH": null,
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Investigation Results",
"static": false,
"w": 1,
"x": 2,
"y": 0
},
{
"h": 2,
"i": "wmtowidpmp-c1842ee0-bdc0-11ee-a451-7b39f6b1cb95",
"items": [],
"maxH": null,
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Verdict",
"query": "VerdictResult",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 1,
"y": 0
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "wmtowidpmp-452c1a00-bdc1-11ee-a451-7b39f6b1cb95",
"items": [
{
"endCol": 6,
"fieldId": "xdralertsearchresults",
"height": 106,
"id": "4b98ffc0-bdc1-11ee-a451-7b39f6b1cb95",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxH": null,
"maxW": 3,
"minH": 1,
"moved": false,
"name": "FOUND RELATED ALERTS",
"static": false,
"w": 3,
"x": 0,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "wmtowidpmp-79b11410-bdc1-11ee-a451-7b39f6b1cb95",
"items": [
{
"args": {},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "99d3be40-bdc2-11ee-a451-7b39f6b1cb95",
"index": 0,
"name": "Clear User's Sessions - Okta ",
"scriptId": "Okta v2|||okta-clear-user-sessions",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "9d567c60-bdc2-11ee-a451-7b39f6b1cb95",
"index": 1,
"name": "Revoke User's Sessions - Azure",
"scriptId": "Microsoft Graph User|||msgraph-user-session-revoke",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "ddbdbf80-d4a0-11ee-a1be-156b316886a1",
"index": 2,
"name": "Reset Password - Active Directory",
"scriptId": "Active Directory Query v2|||ad-set-new-password",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "9eb80830-bdc2-11ee-a451-7b39f6b1cb95",
"index": 3,
"name": "Disable Account",
"scriptId": "DisableUserWrapper",
"sectionItemType": "button",
"startCol": 0
}
],
"maxH": null,
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Response Actions",
"static": false,
"w": 1,
"x": 2,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "wmtowidpmp-a767f590-bdc1-11ee-a451-7b39f6b1cb95",
"items": [
{
"endCol": 2,
"fieldId": "username",
"height": 26,
"id": "30f34b20-bdc2-11ee-a451-7b39f6b1cb95",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "accountstatus",
"height": 26,
"id": "37d783c0-bdc2-11ee-a451-7b39f6b1cb95",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "email",
"height": 26,
"id": "3d0580e0-bdc2-11ee-a451-7b39f6b1cb95",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "accountmemberof",
"height": 26,
"id": "41c8ae40-bdc2-11ee-a451-7b39f6b1cb95",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "cloudaccountid",
"height": 26,
"id": "4738bd70-bdc2-11ee-a451-7b39f6b1cb95",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "accountid",
"height": 26,
"id": "4c778370-bdc2-11ee-a451-7b39f6b1cb95",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "manageremailaddress",
"height": 26,
"id": "535e5420-bdc2-11ee-a451-7b39f6b1cb95",
"index": 6,
"sectionItemType": "field",
"startCol": 0
}
],
"maxH": null,
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Identity Details",
"static": false,
"w": 1,
"x": 0,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "wmtowidpmp-a9ad51b0-bdc1-11ee-a451-7b39f6b1cb95",
"items": [
{
"endCol": 2,
"fieldId": "sourceip",
"height": 26,
"id": "0dc9ad10-bdc2-11ee-a451-7b39f6b1cb95",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "asn",
"height": 26,
"id": "120ef7e0-bdc2-11ee-a451-7b39f6b1cb95",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "countrycode",
"height": 26,
"id": "1b4efad0-bdc2-11ee-a451-7b39f6b1cb95",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "ipreputation",
"height": 26,
"id": "2020f540-bdc2-11ee-a451-7b39f6b1cb95",
"index": 3,
"sectionItemType": "field",
"startCol": 0
}
],
"maxH": null,
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Connection Details",
"static": false,
"w": 1,
"x": 1,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "wmtowidpmp-ac89e4c0-bdc1-11ee-a451-7b39f6b1cb95",
"items": [
{
"endCol": 2,
"fieldId": "alertname",
"height": 26,
"id": "6334e4e0-bdc2-11ee-a451-7b39f6b1cb95",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrdescription",
"height": 26,
"id": "67cae7c0-bdc2-11ee-a451-7b39f6b1cb95",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "detecteduser",
"height": 26,
"id": "27211850-bdd8-11ee-81b8-1dd092d8ebaf",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "detectedips",
"height": 26,
"id": "2b5e73e0-bdd8-11ee-81b8-1dd092d8ebaf",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "occurred",
"height": 26,
"id": "8cfc63c0-bdc2-11ee-a451-7b39f6b1cb95",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "alerttags",
"height": 26,
"id": "8e352020-bde9-11ee-b6e4-23c51981518e",
"index": 5,
"sectionItemType": "field",
"startCol": 0
}
],
"maxH": null,
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Alert Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
}
],
"type": "custom"
},
{
"filters": [
[
{
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "xdralertname"
}
},
"operator": "containsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "First SSO access from ASN in organization"
}
},
"type": "multiSelect"
},
{
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "xdralertname"
}
},
"operator": "containsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "First successful SSO connection from a country in organization"
}
},
"type": "multiSelect"
}
]
],
"hidden": false,
"id": "ytqxqon7uf",
"name": "First SSO access",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-e6soxtwivx-1vduzkpmlh-e6soxtwivx-1vduzkpmlh-6748ea30-8b5b-11ed-8534-dd7eadd1d5dd",
"items": [
{
"endCol": 4,
"fieldId": "alertname",
"height": 22,
"id": "8b8c35a0-8b5b-11ed-8534-dd7eadd1d5dd",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 4,
"fieldId": "xdrdescription",
"height": 22,
"id": "57b7f020-8b6a-11ed-8534-dd7eadd1d5dd",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 4,
"fieldId": "sourceip",
"height": 22,
"id": "8b9fe6e0-8b6a-11ed-8534-dd7eadd1d5dd",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 4,
"fieldId": "detecteduser",
"height": 22,
"id": "9050c4c0-8b6a-11ed-8534-dd7eadd1d5dd",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 4,
"fieldId": "occurred",
"height": 22,
"id": "99b47c50-8b6a-11ed-8534-dd7eadd1d5dd",
"index": 4,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Alert Details",
"static": false,
"w": 2,
"x": 0,
"y": 0,
"description": ""
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-e6soxtwivx-1vduzkpmlh-e6soxtwivx-1vduzkpmlh-b91be240-8b6a-11ed-8534-dd7eadd1d5dd",
"items": [
{
"endCol": 2,
"fieldId": "samaccountname",
"height": 22,
"id": "4e690d90-97f6-11ed-a36a-3f1ec2cc633b",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "accountname",
"height": 22,
"id": "85721b10-8b6c-11ed-8534-dd7eadd1d5dd",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "employeeemail",
"height": 22,
"id": "afd14610-8b6c-11ed-8534-dd7eadd1d5dd",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "accountgroups",
"height": 22,
"id": "b78b6c50-8b6c-11ed-8534-dd7eadd1d5dd",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "managername",
"height": 22,
"id": "bf8d9810-8b6c-11ed-8534-dd7eadd1d5dd",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "manageremailaddress",
"height": 22,
"id": "c81658f0-8b6c-11ed-8534-dd7eadd1d5dd",
"index": 5,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Account Information",
"static": false,
"w": 1,
"x": 1,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-e6soxtwivx-1vduzkpmlh-e6soxtwivx-1vduzkpmlh-76c7cac0-8b6b-11ed-8534-dd7eadd1d5dd",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sourceip",
"height": 22,
"id": "1f8bea40-8b6e-11ed-8f68-b3bf4a3a1ddf",
"index": 0,
"listId": "1vduzkpmlh-76c7cac0-8b6b-11ed-8534-dd7eadd1d5dd",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "asn",
"height": 22,
"id": "161ebcd0-8b6e-11ed-8f68-b3bf4a3a1ddf",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "asnname",
"height": 22,
"id": "c1d02320-8b6e-11ed-8f68-b3bf4a3a1ddf",
"index": 2,
"sectionItemType": "field",
"startCol": 0,
"dropEffect": "move",
"listId": "1vduzkpmlh-76c7cac0-8b6b-11ed-8534-dd7eadd1d5dd"
},
{
"endCol": 2,
"fieldId": "countrycode",
"height": 22,
"id": "26601020-90ba-11ed-8ab6-ab0516dbb87b",
"index": 3,
"sectionItemType": "field",
"startCol": 0,
"dropEffect": "move",
"listId": "1vduzkpmlh-76c7cac0-8b6b-11ed-8534-dd7eadd1d5dd"
},
{
"endCol": 2,
"fieldId": "countryname",
"height": 22,
"id": "37132b60-8b6e-11ed-8f68-b3bf4a3a1ddf",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "ipreputation",
"height": 22,
"id": "0a0b3210-9c86-11ed-b102-9fbd020d1773",
"index": 5,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Connection Information",
"static": false,
"w": 1,
"x": 2,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-e6soxtwivx-1vduzkpmlh-e6soxtwivx-1vduzkpmlh-001975e0-8b70-11ed-9514-c56dac00c61e",
"items": [
{
"endCol": 2,
"fieldId": "userblockstatus",
"height": 22,
"id": "b5f0e930-90dd-11ed-be71-736de8263a17",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "containmentsla",
"height": 22,
"id": "82526ee0-902a-11ed-bbb4-fbf235dd1775",
"index": 0,
"sectionItemType": "field",
"startCol": 0,
"dropEffect": "move",
"listId": "1vduzkpmlh-001975e0-8b70-11ed-9514-c56dac00c61e"
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "remediationsla",
"height": 22,
"id": "e7ffdd50-91a5-11ed-941b-e567ac08eaae",
"index": 1,
"listId": "1vduzkpmlh-001975e0-8b70-11ed-9514-c56dac00c61e",
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Containment and Remediation status",
"static": false,
"w": 1,
"x": 2,
"y": 0
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "1vduzkpmlh-e6soxtwivx-1vduzkpmlh-e6soxtwivx-1vduzkpmlh-b3c63170-8c31-11ed-a026-b1d5b381234f",
"items": [
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "relatedreport",
"height": 22,
"id": "f782bd20-8c31-11ed-a026-b1d5b381234f",
"index": 0,
"listId": "1vduzkpmlh-b3c63170-8c31-11ed-a026-b1d5b381234f",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "partofcampaign",
"height": 22,
"id": "0c60e1d0-8c33-11ed-a026-b1d5b381234f",
"index": 1,
"listId": "1vduzkpmlh-e1c742c0-8b6a-11ed-8534-dd7eadd1d5dd",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "xdralertsearchresults",
"height": 106,
"id": "e982e840-8b6d-11ed-8f68-b3bf4a3a1ddf",
"index": 2,
"listId": "1vduzkpmlh-b3c63170-8c31-11ed-a026-b1d5b381234f",
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Investigation Details",
"static": false,
"w": 2,
"x": 1,
"y": 4
},
{
"displayType": "ROW",
"h": 5,
"hideName": false,
"i": "1vduzkpmlh-e6soxtwivx-1vduzkpmlh-6d2f0be0-9660-11ed-a2af-cd9affeb35c4",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "verdict",
"height": 22,
"id": "65731ac0-9027-11ed-bbb4-fbf235dd1775",
"index": 0,
"listId": "1vduzkpmlh-e6soxtwivx-1vduzkpmlh-6d2f0be0-9660-11ed-a2af-cd9affeb35c4",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrinvestigationresults",
"height": 106,
"id": "482ac9c0-a23a-11ed-b1e2-670240eb75b1",
"index": 1,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Verdict Results Parameters",
"static": false,
"w": 1,
"x": 0,
"y": 2
}
],
"type": "custom"
},
{
"filters": [
[
{
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "xdralertname"
}
},
"operator": "containsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "Possible external RDP Brute-Force"
}
},
"type": "multiSelect"
}
]
],
"hidden": false,
"id": "ilvvquvjmw",
"name": "RDP Brute Force",
"sections": [
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "1vduzkpmlh-ilvvquvjmw-lthdv5gwt9-1vduzkpmlh-ilvvquvjmw-1vduzkpmlh-ilvvquvjmw-field-changed-ilvvquvjmw-1vduzkpmlh-65d10ac0-85ca-11ed-b726-2bebafbeec3c",
"items": [
{
"endCol": 2,
"fieldId": "alertname",
"height": 22,
"id": "a563d0d0-85f4-11ed-bc30-fb13783e8b89",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrdescription",
"height": 22,
"id": "b7fed8c0-85f4-11ed-bc30-fb13783e8b89",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceip",
"height": 22,
"id": "4b936a20-85f4-11ed-bc30-fb13783e8b89",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "asn",
"height": 22,
"id": "1c4b8df0-8ff0-11ed-9ed2-f34d28ec0876",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "detecteduser",
"height": 22,
"id": "5bb1d950-85f4-11ed-bc30-fb13783e8b89",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "destinationhostname",
"height": 22,
"id": "87676c90-85f4-11ed-bc30-fb13783e8b89",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "occurred",
"height": 22,
"id": "f0b86bc0-89d9-11ed-8ec7-dd26932d7bf0",
"index": 6,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Alert Details ",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "CARD",
"h": 3,
"hideName": false,
"i": "1vduzkpmlh-ilvvquvjmw-lthdv5gwt9-1vduzkpmlh-ilvvquvjmw-1vduzkpmlh-ilvvquvjmw-field-changed-ilvvquvjmw-1vduzkpmlh-d39faee0-85f6-11ed-bc30-fb13783e8b89",
"items": [
{
"endCol": 2,
"fieldId": "userblockstatus",
"height": 53,
"id": "e642a610-85f6-11ed-bc30-fb13783e8b89",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "ipblockedstatus",
"height": 53,
"id": "1b787990-85f7-11ed-bc30-fb13783e8b89",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "endpointisolationstatus",
"height": 53,
"id": "4ec0cd80-86be-11ed-b2e7-e58c08fe2d4a",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "containmentsla",
"height": 53,
"id": "44164130-8786-11ed-9291-41f0d693e13d",
"index": 1,
"listId": "1vduzkpmlh-ilvvquvjmw-1vduzkpmlh-ilvvquvjmw-field-changed-ilvvquvjmw-1vduzkpmlh-d39faee0-85f6-11ed-bc30-fb13783e8b89",
"sectionItemType": "field",
"startCol": 2
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Containment Status",
"static": false,
"w": 1,
"x": 2,
"y": 0
},
{
"description": "This section outlines the investigation steps, the results obtained, and the elements identified as suspicious.",
"displayType": "ROW",
"h": 6,
"hideName": false,
"i": "1vduzkpmlh-ilvvquvjmw-lthdv5gwt9-1vduzkpmlh-ilvvquvjmw-1vduzkpmlh-ilvvquvjmw-field-changed-ilvvquvjmw-1vduzkpmlh-4230d1c0-85f9-11ed-bc30-fb13783e8b89",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "ipreputation",
"height": 22,
"id": "b1101230-868b-11ed-95d3-9b591fefb5ee",
"index": 0,
"listId": "1vduzkpmlh-ilvvquvjmw-field-changed-ilvvquvjmw-1vduzkpmlh-4230d1c0-85f9-11ed-bc30-fb13783e8b89",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "partofcampaign",
"height": 22,
"id": "925888a0-85f9-11ed-bc30-fb13783e8b89",
"index": 2,
"listId": "1vduzkpmlh-4230d1c0-85f9-11ed-bc30-fb13783e8b89",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "relatedreport",
"height": 22,
"id": "e764f3c0-89cc-11ed-bac7-89f49b97fccb",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "huntresultscount",
"height": 22,
"id": "fb73e6a0-9296-11ed-a63d-f351ec4db56c",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourcegeolocation",
"height": 22,
"id": "507788d0-85fb-11ed-bc30-fb13783e8b89",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "userengagementresponse",
"height": 22,
"id": "f11c0710-8b6f-11ed-afb3-d73a6f2ed22f",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "verdict",
"height": 22,
"id": "93b17190-86ac-11ed-b416-1138ff09b27a",
"index": 7,
"listId": "1vduzkpmlh-ilvvquvjmw-1vduzkpmlh-ilvvquvjmw-field-changed-ilvvquvjmw-1vduzkpmlh-4230d1c0-85f9-11ed-bc30-fb13783e8b89",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 6,
"fieldId": "xdralertsearchresults",
"height": 106,
"id": "0a7f2400-928a-11ed-bb51-0fc8bdf0929c",
"index": 8,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 4,
"fieldId": "triagesla",
"height": 22,
"id": "b1af3fd0-8aa6-11ed-ab4d-cd6180c65924",
"index": 0,
"sectionItemType": "field",
"startCol": 2
},
{
"endCol": 4,
"fieldId": "remediationsla",
"height": 22,
"id": "acc5cf20-ffbd-11ed-94dc-8177260b8024",
"index": 1,
"sectionItemType": "field",
"startCol": 2
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Investigation Details",
"static": false,
"w": 3,
"x": 0,
"y": 3
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "1vduzkpmlh-ilvvquvjmw-lthdv5gwt9-1vduzkpmlh-52a5fd00-8a9a-11ed-88e5-8f076c01d056",
"items": [
{
"endCol": 2,
"fieldId": "accountname",
"height": 22,
"id": "9b4f3710-8a9a-11ed-88e5-8f076c01d056",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "employeeemail",
"height": 22,
"id": "52a327c0-8aa3-11ed-80bd-535489c9b11e",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "accountgroups",
"height": 22,
"id": "ae4caa50-8a9a-11ed-88e5-8f076c01d056",
"index": 2,
"listId": "1vduzkpmlh-52a5fd00-8a9a-11ed-88e5-8f076c01d056",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "managername",
"height": 22,
"id": "a7a0e6d0-8a9a-11ed-88e5-8f076c01d056",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "manageremailaddress",
"height": 22,
"id": "40f258c0-8aa3-11ed-80bd-535489c9b11e",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "usercreationtime",
"height": 22,
"id": "788c6590-8aa4-11ed-91e3-bd2dab60253a",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "passwordchangeddate",
"height": 22,
"id": "73938230-8aa4-11ed-91e3-bd2dab60253a",
"index": 5,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Account Information",
"static": false,
"w": 1,
"x": 1,
"y": 0
}
],
"type": "custom"
},
{
"filters": [
[
{
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "xdralertname"
}
},
"operator": "containsGeneral",
"right": {
"isContext": false,
"value": {
"simple": "Large Upload"
}
},
"type": "multiSelect"
}
]
],
"hidden": false,
"id": "vycnvdgk6l",
"name": "Large Upload",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-6774ac10-dfdd-11ee-a718-2d25454b6746",
"items": [
{
"endCol": 2,
"fieldId": "alertname",
"height": 22,
"id": "7fc88c00-dfdd-11ee-a718-2d25454b6746",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrdescription",
"height": 22,
"id": "8640e370-dfdd-11ee-a718-2d25454b6746",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "occurred",
"height": 22,
"id": "bb2f26a0-dfdd-11ee-a718-2d25454b6746",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "hostname",
"height": 22,
"id": "f9cac5d0-dfe3-11ee-a718-2d25454b6746",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdrusers",
"height": 22,
"id": "17b59de0-dfe4-11ee-a718-2d25454b6746",
"index": 4,
"listId": "1vduzkpmlh-6774ac10-dfdd-11ee-a718-2d25454b6746",
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Alert Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-469b1ee0-dfe5-11ee-a718-2d25454b6746",
"items": [
{
"endCol": 6,
"fieldId": "xdrnetworkartifacts",
"height": 106,
"id": "11883550-dfe8-11ee-a718-2d25454b6746",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Network Artifacts",
"static": false,
"w": 3,
"x": 0,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-8a36af70-e071-11ee-9f1d-c7e880f68802",
"items": [
{
"endCol": 2,
"fieldId": "verdict",
"height": 22,
"id": "534d3880-e071-11ee-9f1d-c7e880f68802",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "partofcampaign",
"height": 22,
"id": "a2f3d880-e071-11ee-9f1d-c7e880f68802",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "relatedreport",
"height": 22,
"id": "ab7c7250-e071-11ee-9f1d-c7e880f68802",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "commandline",
"height": 22,
"id": "7ae9b4c0-dfe7-11ee-a718-2d25454b6746",
"index": 3,
"listId": "1vduzkpmlh-fc683030-dfe7-11ee-a718-2d25454b6746",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "commandlineverdict",
"height": 22,
"id": "c51aa040-dfe7-11ee-a718-2d25454b6746",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "threathuntingdetectedhostnames",
"height": 22,
"id": "f14e00a0-e148-11ee-9a3d-4f29cba1e42e",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "threathuntingdetectedip",
"height": 22,
"id": "f4749500-e148-11ee-9a3d-4f29cba1e42e",
"index": 6,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Investigation Details",
"static": false,
"w": 1,
"x": 1,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-ea6fb620-e071-11ee-9f1d-c7e880f68802",
"items": [
{
"endCol": 2,
"fieldId": "containmentsla",
"height": 22,
"id": "955e68b0-e072-11ee-9f1d-c7e880f68802",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "remediationsla",
"height": 22,
"id": "a8baebe0-e072-11ee-9f1d-c7e880f68802",
"index": 1,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Containment and Remediation Status",
"static": false,
"w": 1,
"x": 2,
"y": 0
}
],
"type": "custom"
},
{
"hidden": false,
"id": "lthdv5gwt9",
"name": "Similar Incidents",
"sections": [
{
"displayType": "ROW",
"h": 7,
"hideName": true,
"i": "lthdv5gwt9-1vduzkpmlh-lthdv5gwt9-d986a3c0-abfc-11eb-9d9c-cffd34bfbbb3",
"items": [
{
"dropEffect": "move",
"endCol": 6,
"fieldId": "xdrsimilarincidents",
"height": 106,
"id": "e18d8a70-abfc-11eb-9d9c-cffd34bfbbb3",
"index": 0,
"listId": "1vduzkpmlh-lthdv5gwt9-d986a3c0-abfc-11eb-9d9c-cffd34bfbbb3",
"sectionItemType": "field",
"startCol": 0
}
],
"maxH": null,
"maxW": 3,
"minH": 1,
"minW": 3,
"moved": false,
"name": "XDR Similar Incidents",
"static": false,
"w": 3,
"x": 0,
"y": 0
}
],
"type": "custom"
},
{
"id": "warRoom",
"name": "War Room",
"type": "warRoom"
},
{
"id": "workPlan",
"name": "Work Plan",
"type": "workPlan"
},
{
"id": "evidenceBoard",
"name": "Evidence Board",
"type": "evidenceBoard"
},
{
"id": "relatedIncidents",
"name": "Related Incidents",
"type": "relatedIncidents"
},
{
"id": "canvas",
"name": "Canvas",
"type": "canvas"
}
]
},
"group": "incident",
"id": "Cortex XDR Incident",
"name": "Cortex XDR Incident",
"system": false,
"version": -1,
"fromVersion": "6.8.0",
"description": "",
"marketplaces": ["xsoar"]
}