Default
Core Incident
Details
| ID | Default |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.8.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Alert Overview 9 sections
Alert Details
| Field ID | Position |
|---|---|
| timestamp | Col 0-2, Height: 26 |
| alertid | Col 0-2, Height: 26 |
| type | Col 0-2, Height: 26 |
| playbookid | Col 0-2, Height: 26 |
| sourcehostname | Col 0-2, Height: 26 |
| sourceip | Col 0-2, Height: 26 |
| severity | Col 0-2, Height: 26 |
| sourcebrand | Col 0-2, Height: 26 |
| sourceinstance | Col 0-2, Height: 26 |
Notes
Work Plan
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 26 |
| closereason | Col 0-2, Height: 26 |
| closenotes | Col 0-2, Height: 52 |
Command and Task Results
Malicious or Suspicious Indicators
Indicators Handling
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
Analytics Prevalence Check
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
Technical Information 4 sections
Destination Details
| Field ID | Position |
|---|---|
| agent_ip_addresses | Col 0-2, Height: 26 |
| remotehost | Col 0-2, Height: 26 |
| remoteip | Col 0-2, Height: 26 |
| remoteport | Col 0-2, Height: 26 |
| emailrecipient | Col 0-2, Height: 26 |
| targetprocessname | Col 0-2, Height: 26 |
| targetprocesssha256 | Col 0-2, Height: 26 |
| targetprocesscmd | Col 0-2, Height: 26 |
| filename | Col 0-2, Height: 26 |
| filemd5 | Col 0-2, Height: 26 |
| filesha256 | Col 0-2, Height: 26 |
| filepath | Col 0-2, Height: 26 |
Mapped Fields
Unmapped fields
| Field ID | Position |
|---|---|
| incident_labels | Col 0-2, Height: 26 |
Source Details
| Field ID | Position |
|---|---|
| hostname | Col 0-2, Height: 26 |
| localip | Col 0-2, Height: 26 |
| localport | Col 0-2, Height: 26 |
| username | Col 0-2, Height: 26 |
| emailsender | Col 0-2, Height: 26 |
| initiatedby | Col 0-2, Height: 26 |
| initiatormd5 | Col 0-2, Height: 26 |
| initiatorsha256 | Col 0-2, Height: 26 |
| initiatorcmd | Col 0-2, Height: 26 |
Investigation Tools 6 sections
Data Formats
| Field ID | Position |
|---|---|
| — | Col 0-1, Height: 44 |
| — | Col 0-1, Height: 44 |
| — | Col 1-2, Height: 44 |
| — | Col 1-2, Height: 44 |
En/Decoding
| Field ID | Position |
|---|---|
| — | Col 0-1, Height: 44 |
| — | Col 1-2, Height: 44 |
File Analysis
| Field ID | Position |
|---|---|
| — | Col 0-1, Height: 44 |
Network Utils
| Field ID | Position |
|---|---|
| — | Col 0-1, Height: 44 |
| — | Col 0-1, Height: 44 |
| — | Col 1-2, Height: 44 |
| — | Col 1-2, Height: 44 |
Results
When you click a button in this tab - the execution results will be displayed here. To clear this table click “clear results“.
Clear Results
Clear the results table
| Field ID | Position |
|---|---|
| — | Col 2-4, Height: 44 |
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Canvas 0 sections
No sections defined.