CrowdStrike Falcon Layout
CrowdStrike Falcon Incident
Details
| ID | CrowdStrike Falcon Layout |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.0.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Incident Info 11 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 22 |
| severity | Col 0-2, Height: 22 |
| owner | Col 0-2, Height: 22 |
| sourcebrand | Col 0-2, Height: 22 |
| sourceinstance | Col 0-2, Height: 22 |
| playbookid | Col 0-2, Height: 22 |
Notes
Work Plan
Linked Incidents
Child Incidents
Evidence
Team Members
Indicators
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-1, Height: 22 |
| dbotmodified | Col 0-1, Height: 22 |
| dbotduedate | Col 0-2, Height: 22 |
| dbotcreated | Col 1-2, Height: 22 |
| dbotclosed | Col 1-2, Height: 22 |
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 22 |
| closereason | Col 0-2, Height: 22 |
| closenotes | Col 0-2, Height: 22 |
Investigation Data
| Field ID | Position |
|---|---|
| details | Col 0-2, Height: 22 |
Investigation 5 sections
Process Information
| Field ID | Position |
|---|---|
| filenames | Col 0-2, Height: 26 |
| filepaths | Col 0-2, Height: 26 |
| processcmd | Col 0-2, Height: 26 |
| processid | Col 0-2, Height: 26 |
| processmd5 | Col 0-2, Height: 26 |
| processsha256 | Col 0-2, Height: 26 |
Policy Actions
Grand Parent Process information
Parent Process Information
CrowdStrike General Info
| Field ID | Position |
|---|---|
| externallink | Col 0-2, Height: 26 |
| externalcategoryname | Col 0-2, Height: 26 |
| externalconfidence | Col 0-2, Height: 26 |
| externalseverity | Col 0-2, Height: 26 |
| externalsystemid | Col 0-2, Height: 26 |
| hostnames | Col 0-2, Height: 26 |
| agentsid | Col 0-2, Height: 26 |
| deviceosname | Col 0-2, Height: 26 |
| deviceosversion | Col 0-2, Height: 26 |
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.
CSPM IOM 1 section
Resource Attributes
CSPM IOA 4 sections
Response Elements
User Identity
Request Parameters
Enrichments
IOC Types 1 section
IOC Types
| Field ID | Position |
|---|---|
| crowdstrikefalconioctypes | Col 0-2, Height: 22 |
At Accounts 1 section
At Accounts
| Field ID | Position |
|---|---|
| crowdstrikefalconataccounts | Col 0-2, Height: 22 |
IOC CVES 1 section
IOC CVES
| Field ID | Position |
|---|---|
| crowdstrikefalconioccves | Col 0-2, Height: 22 |
IOC Domains 1 section
IOC Domains
| Field ID | Position |
|---|---|
| crowdstrikefalconiocdomains | Col 0-2, Height: 22 |
IOC Emails 1 section
IOC Emails
| Field ID | Position |
|---|---|
| crowdstrikefalconiocemails | Col 0-2, Height: 22 |
IOC Hashtags 1 section
IOC Hashtags
| Field ID | Position |
|---|---|
| crowdstrikefalconiochashtags | Col 0-2, Height: 22 |
IOC Urls 1 section
IOC Urls
| Field ID | Position |
|---|---|
| crowdstrikefalconiocurls | Col 0-2, Height: 22 |