{
"id": "Cortex XDR Port Scan",
"group": "incident",
"name": "Cortex XDR Port Scan",
"description": "",
"version": -1,
"fromVersion": "6.0.0",
"detailsV2": {
"tabs": [
{
"hidden": false,
"id": "1vduzkpmlh",
"name": "Case info",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "type",
"height": 24,
"id": "1cc0c4a0-9bd7-11e9-ba23-8723b1f1df6b",
"index": 0,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "dbotsource",
"height": 24,
"id": "87e18ad0-9bd7-11e9-ba23-8723b1f1df6b",
"index": 1,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceinstance",
"height": 24,
"id": "43cfe2d0-9bee-11e9-9a3f-8b4b2158e260",
"index": 2,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sourcebrand",
"height": 24,
"id": "42f03130-9bee-11e9-9a3f-8b4b2158e260",
"index": 3,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "severity",
"height": 24,
"id": "20430d90-9bd7-11e9-ba23-8723b1f1df6b",
"index": 4,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "owner",
"height": 24,
"id": "4fd2b640-a7d6-11e9-8433-9f52f2917950",
"index": 5,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "playbookid",
"height": 24,
"id": "930bb7a0-a866-11e9-aeb8-c3448b5d692d",
"index": 6,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Case Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Notes",
"readOnly": true,
"static": false,
"type": "notes",
"w": 1,
"x": 2,
"y": 4
},
{
"columns": [
{
"displayed": true,
"isDefault": false,
"key": "id",
"width": 110
},
{
"displayed": true,
"isDefault": true,
"key": "name",
"width": 300
},
{
"displayed": true,
"isDefault": false,
"key": "owner",
"width": 160
},
{
"displayed": true,
"isDefault": true,
"key": "type",
"width": 200
},
{
"displayed": true,
"isDefault": true,
"key": "status",
"width": 80
},
{
"displayed": true,
"isDefault": true,
"key": "closeNotes",
"width": 300
}
],
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "1vduzkpmlh-770ec200-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Linked Incidents",
"readOnly": true,
"static": false,
"type": "linkedIncidents",
"w": 1,
"x": 1,
"y": 6
},
{
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "1vduzkpmlh-842632c0-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Child Incidents",
"readOnly": true,
"static": false,
"type": "childInv",
"w": 1,
"x": 1,
"y": 7
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-4a31afa0-98ba-11e9-a519-93a53c759fe0",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Evidence",
"readOnly": true,
"static": false,
"type": "evidence",
"w": 1,
"x": 0,
"y": 6
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-7717e580-9bed-11e9-9a3f-8b4b2158e260",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Team Members",
"readOnly": true,
"static": false,
"type": "team",
"w": 1,
"x": 1,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"isVisible": true,
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotcreated",
"height": 24,
"id": "930bf0a0-a864-11e9-aeb8-c3448b5d692d",
"index": 0,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "occurred",
"height": 24,
"id": "e92b52b0-a863-11e9-aeb8-c3448b5d692d",
"index": 1,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "dbotmodified",
"height": 24,
"id": "99cbd860-a864-11e9-aeb8-c3448b5d692d",
"index": 2,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotclosed",
"height": 24,
"id": "a1a67ef0-a864-11e9-aeb8-c3448b5d692d",
"index": 3,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "remediationsla",
"height": 24,
"id": "6cd9de10-9bee-11e9-9a3f-8b4b2158e260",
"index": 4,
"listId": "24257a20-98b1-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "detectionsla",
"height": 24,
"id": "6b72acf0-9bee-11e9-9a3f-8b4b2158e260",
"index": 5,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotduedate",
"height": 24,
"id": "551d6320-a7d6-11e9-8433-9f52f2917950",
"index": 6,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Timeline Information",
"static": false,
"w": 1,
"x": 0,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-e462ffc0-a864-11e9-aeb8-c3448b5d692d",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "xdrresolvecomment",
"height": 24,
"id": "5a450d90-ac8a-11e9-a30b-53d47e1ea7d7",
"index": 0,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotclosed",
"height": 24,
"id": "427bf020-a866-11e9-aeb8-c3448b5d692d",
"index": 1,
"listId": "e462ffc0-a864-11e9-aeb8-c3448b5d692d",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closereason",
"height": 24,
"id": "f23f6e30-a864-11e9-aeb8-c3448b5d692d",
"index": 2,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closinguserid",
"height": 24,
"id": "f387a5a0-a864-11e9-aeb8-c3448b5d692d",
"index": 3,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closenotes",
"height": 48,
"id": "f579ffc0-a864-11e9-aeb8-c3448b5d692d",
"index": 4,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Closing Information",
"static": false,
"w": 1,
"x": 2,
"y": 6
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"items": [
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "xdrdescription",
"height": 24,
"id": "a398d4f0-ac89-11e9-a30b-53d47e1ea7d7",
"index": 0,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrincidentid",
"height": 24,
"id": "3ebb4a40-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 1,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrstatus",
"height": 24,
"id": "4f80f5f0-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 2,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "description",
"height": 24,
"id": "4b1ead40-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 3,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrhostcount",
"height": 24,
"id": "5d54d8e0-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 3,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrusercount",
"height": 24,
"id": "b1232bc0-ac89-11e9-a30b-53d47e1ea7d7",
"index": 4,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "xdrnotes",
"height": 24,
"id": "8f040360-ac8a-11e9-a30b-53d47e1ea7d7",
"index": 5,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "xdrurl",
"height": 24,
"id": "df4e1380-aef4-11e9-896e-b72bc9d2cace",
"index": 6,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "xdralertcount",
"height": 24,
"id": "53bb4440-ac7a-11e9-a30b-53d47e1ea7d7",
"index": 1,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"startCol": 2
},
{
"endCol": 4,
"fieldId": "xdrhighseverityalertcount",
"height": 24,
"id": "407735a0-ac7b-11e9-a30b-53d47e1ea7d7",
"index": 2,
"startCol": 2
},
{
"endCol": 4,
"fieldId": "xdrmediumseverityalertcount",
"height": 24,
"id": "42b2a6b0-ac7b-11e9-a30b-53d47e1ea7d7",
"index": 2,
"startCol": 2
},
{
"endCol": 4,
"fieldId": "xdrlowseverityalertcount",
"height": 24,
"id": "440ae3b0-ac7b-11e9-a30b-53d47e1ea7d7",
"index": 2,
"startCol": 2
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "xdrassigneduserprettyname",
"height": 24,
"id": "688064a0-ad29-11e9-b20c-1b6878c52e9c",
"index": 2,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"startCol": 2
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "xdrassigneduseremail",
"height": 24,
"id": "3704da40-ac8a-11e9-a30b-53d47e1ea7d7",
"index": 3,
"listId": "d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"startCol": 2
},
{
"endCol": 4,
"fieldId": "sourceip",
"height": 24,
"id": "b23985a0-589f-11ea-aa57-912340094d12",
"index": 4,
"startCol": 2
},
{
"endCol": 4,
"fieldId": "sourcehostname",
"height": 24,
"id": "b4d89a80-589f-11ea-aa57-912340094d12",
"index": 5,
"startCol": 2
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "investigationstage",
"height": 24,
"id": "fca77a20-589f-11ea-aa57-912340094d12",
"index": 6,
"listId": "1vduzkpmlh-d8316060-ac70-11e9-a30b-53d47e1ea7d7",
"startCol": 2
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "XDR Basic Information",
"static": false,
"w": 2,
"x": 1,
"y": 0
},
{
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-6f1661f0-ad44-11e9-a569-716c95c51bfe",
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Related Alerts Severity",
"query": "EntryWidgetPieAlertsXDR",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 0,
"y": 2
},
{
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-5cc7f260-ad4f-11e9-a2d3-c520aeb407da",
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Affected Hosts Count",
"query": "EntryWidgetNumberHostsXDR",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 1,
"y": 2
},
{
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-11cd1fd0-ad52-11e9-a2d3-c520aeb407da",
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Affected Users Count",
"query": "EntryWidgetNumberUsersXDR",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 2,
"y": 2
}
],
"type": "custom"
},
{
"hidden": false,
"id": "swtuqptgvs",
"name": "Alert \u0026 Artifacts",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "swtuqptgvs-067d4900-98b4-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Incident Files",
"query": {
"categories": [
"attachments"
],
"lastId": "",
"pageSize": 100,
"tags": [],
"users": []
},
"queryType": "warRoomFilter",
"readOnly": true,
"static": false,
"type": "invTimeline",
"w": 1,
"x": 2,
"y": 9
},
{
"displayType": "ROW",
"h": 4,
"hideName": false,
"i": "swtuqptgvs-cc557320-98b7-11e9-b34a-852d068f44fe",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Indicators",
"query": "",
"queryType": "input",
"readOnly": true,
"static": false,
"type": "indicators",
"w": 2,
"x": 0,
"y": 9
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "swtuqptgvs-075ee440-cc9a-11e9-afca-8792f3871db0",
"items": [
{
"endCol": 6,
"fieldId": "xdralerts",
"height": 110,
"id": "1b6eb1e0-cc9a-11e9-afca-8792f3871db0",
"index": 0,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "XDR Alerts",
"static": false,
"w": 3,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "swtuqptgvs-2ff499e0-cc9a-11e9-afca-8792f3871db0",
"items": [
{
"endCol": 6,
"fieldId": "xdrfileartifacts",
"height": 110,
"id": "447eeeb0-cc9a-11e9-afca-8792f3871db0",
"index": 0,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "XDR File Artifacts",
"static": false,
"w": 3,
"x": 0,
"y": 3
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "swtuqptgvs-3604e0b0-cc9a-11e9-afca-8792f3871db0",
"items": [
{
"endCol": 6,
"fieldId": "xdrnetworkartifacts",
"height": 110,
"id": "498825c0-cc9a-11e9-afca-8792f3871db0",
"index": 0,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "XDR Network Artifacts",
"static": false,
"w": 3,
"x": 0,
"y": 6
}
],
"type": "custom"
},
{
"id": "warRoom",
"name": "War Room",
"type": "warRoom"
},
{
"id": "workPlan",
"name": "Work Plan",
"type": "workPlan"
},
{
"id": "evidenceBoard",
"name": "Evidence Board",
"type": "evidenceBoard"
},
{
"id": "relatedIncidents",
"name": "Related Incidents",
"type": "relatedIncidents"
},
{
"id": "canvas",
"name": "Canvas",
"type": "canvas"
}
]
}
}