{
"detailsV2": {
"tabs": [
{
"id": "summary",
"name": "Legacy Summary",
"type": "summary"
},
{
"id": "w68olunplf",
"name": "Alert Overview",
"sections": [
{
"displayType": "ROW",
"h": 2,
"i": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "timestamp",
"height": 26,
"id": "ca3282e0-ac81-11ed-90e1-81bc84c0d1fb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "alertid",
"height": 26,
"id": "abb90370-2762-11ec-9959-2922ebe0f011",
"index": 1,
"listId": "3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "type",
"height": 26,
"id": "incident-type-field",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "playbookid",
"height": 26,
"id": "incident-playbookId-field",
"index": 3,
"listId": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sourcehostname",
"height": 26,
"id": "bfb2d810-2762-11ec-9959-2922ebe0f011",
"index": 4,
"listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceip",
"height": 26,
"id": "c28fb940-2762-11ec-9959-2922ebe0f011",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "severity",
"height": 26,
"id": "incident-severity-field",
"index": 6,
"listId": "3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourcebrand",
"height": 26,
"id": "incident-sourceBrand-field",
"index": 7,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceinstance",
"height": 26,
"id": "incident-sourceInstance-field",
"index": 8,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Alert Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"h": 2,
"i": "w68olunplf-3podiwrjhh-caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Notes",
"static": false,
"type": "notes",
"w": 1,
"x": 1,
"y": 4
},
{
"displayType": "ROW",
"h": 3,
"i": "w68olunplf-3podiwrjhh-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Work Plan",
"static": false,
"type": "workplan",
"w": 1,
"x": 2,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"i": "w68olunplf-3podiwrjhh-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "dbotclosed",
"height": 26,
"id": "incident-dbotClosed-field",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closereason",
"height": 26,
"id": "incident-closeReason-field",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closenotes",
"height": 52,
"id": "incident-closeNotes-field",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Closing Information",
"static": false,
"w": 1,
"x": 0,
"y": 4
},
{
"h": 4,
"i": "w68olunplf-3podiwrjhh-9e343160-ac82-11ed-90e1-81bc84c0d1fb",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Command and Task Results",
"query": {
"categories": [
"commandAndResults",
"playbookTaskResult",
"playbookTaskStartAndDone",
"playbookErrors"
],
"preDefinedFilters": true,
"tags": []
},
"queryType": "warRoomFilter",
"static": false,
"type": "invTimeline",
"w": 1,
"x": 1,
"y": 0
},
{
"h": 3,
"i": "w68olunplf-3podiwrjhh-22ce89f0-b040-11ed-95eb-6fbf73c92c07",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Malicious or Suspicious Indicators",
"query": "reputation:Bad or reputation:Suspicious",
"queryType": "input",
"static": false,
"type": "indicators",
"w": 2,
"x": 0,
"y": 6
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "w68olunplf-3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"items": [
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "cabada80-b057-11ed-95eb-6fbf73c92c07",
"index": 0,
"listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"name": "Extract indicators from text file",
"scriptId": "ExtractIndicatorsFromTextFile",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"exclude_TLD": {
"simple": "",
"userMarkedRequired": true
},
"exclude_indicators": {
"simple": "",
"userMarkedRequired": true
},
"unescape_domain": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "cc0ed1c0-b057-11ed-95eb-6fbf73c92c07",
"index": 1,
"listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"name": "Extract indicators from a blog",
"scriptId": "ParseHTMLIndicators",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"using-brand": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "cd789af0-b057-11ed-95eb-6fbf73c92c07",
"index": 2,
"listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"name": "Enrich indicators",
"scriptId": "Builtin|||enrichIndicators",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "199cd250-b055-11ed-95eb-6fbf73c92c07",
"index": 3,
"listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"name": "Tag Indicators",
"scriptId": "AppendindicatorFieldWrapper",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"comment": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "1760ec10-b055-11ed-95eb-6fbf73c92c07",
"index": 4,
"name": "Block Hash List",
"scriptId": "Cortex Core - IR|||core-blocklist-files",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"comment": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "success",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "18782870-b055-11ed-95eb-6fbf73c92c07",
"index": 5,
"name": "Allow Hash List",
"scriptId": "Cortex Core - IR|||core-allowlist-files",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Indicators Handling",
"static": false,
"w": 1,
"x": 2,
"y": 6
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "w68olunplf-3podiwrjhh-c0edb6d0-b1d8-11ed-922b-b50d0a485e48",
"items": [
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "557b46d0-b1db-11ed-922b-b50d0a485e48",
"index": 0,
"name": "Domain Prevalence",
"scriptId": "Cortex Core - IR|||core-get-domain-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "5231c120-b1db-11ed-922b-b50d0a485e48",
"index": 1,
"name": "IP Prevalence",
"scriptId": "Cortex Core - IR|||core-get-IP-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "5359ed70-b1db-11ed-922b-b50d0a485e48",
"index": 2,
"name": "Hash Prevalence",
"scriptId": "Cortex Core - IR|||core-get-hash-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "56c44190-b1db-11ed-922b-b50d0a485e48",
"index": 3,
"name": "Process Prevalence",
"scriptId": "Cortex Core - IR|||core-get-process-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "57db2fd0-b1db-11ed-922b-b50d0a485e48",
"index": 4,
"name": "CMD Prevalence",
"scriptId": "Cortex Core - IR|||core-get-cmd-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "59147320-b1db-11ed-922b-b50d0a485e48",
"index": 5,
"name": "Registry Prevalence",
"scriptId": "Cortex Core - IR|||core-get-registry-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Analytics Prevalence Check",
"static": false,
"w": 1,
"x": 2,
"y": 3
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "w68olunplf-3podiwrjhh-68821790-b77b-11ed-a817-f75b1612b8eb",
"items": [
{
"endCol": 2,
"fieldId": "hostname",
"height": 26,
"id": "81791550-b77b-11ed-a817-f75b1612b8eb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "hostip",
"height": 26,
"id": "831d4f70-b77b-11ed-a817-f75b1612b8eb",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "username",
"height": 26,
"id": "88fe9700-b77b-11ed-a817-f75b1612b8eb",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Target Identification",
"static": false,
"w": 1,
"x": 0,
"y": 2
}
],
"showEmptyFields": true,
"type": "custom"
},
{
"hidden": false,
"id": "xxtngoiqpq",
"name": "Technical Information",
"sections": [
{
"displayType": "ROW",
"h": 4,
"hideName": false,
"i": "3podiwrjhh-caseinfoid-38f848d0-9a45-11ed-aff5-5d4496197108",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "agent_ip_addresses",
"height": 26,
"id": "b7595950-a2e5-11ed-81fe-3f9032ac5cab",
"index": -2,
"listId": "3podiwrjhh-caseinfoid-38f848d0-9a45-11ed-aff5-5d4496197108",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "remotehost",
"height": 26,
"id": "84f9a7d0-b73f-11ed-977b-dd8e6ac87856",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "remoteip",
"height": 26,
"id": "73f879c0-b73f-11ed-977b-dd8e6ac87856",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "remoteport",
"height": 26,
"id": "771ceb40-b73f-11ed-977b-dd8e6ac87856",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "emailrecipient",
"height": 26,
"id": "068bfa90-b75a-11ed-b1c8-ebf36972036b",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "targetprocessname",
"height": 26,
"id": "a4917850-b75a-11ed-b1c8-ebf36972036b",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "targetprocesssha256",
"height": 26,
"id": "a5cb30d0-b75a-11ed-b1c8-ebf36972036b",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "targetprocesscmd",
"height": 26,
"id": "a6abf3e0-b75a-11ed-b1c8-ebf36972036b",
"index": 7,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filename",
"height": 26,
"id": "2d64c880-b75b-11ed-b1c8-ebf36972036b",
"index": 8,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filemd5",
"height": 26,
"id": "30bcf430-b75b-11ed-b1c8-ebf36972036b",
"index": 9,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filesha256",
"height": 26,
"id": "32744120-b75b-11ed-b1c8-ebf36972036b",
"index": 10,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filepath",
"height": 26,
"id": "33aa2910-b75b-11ed-b1c8-ebf36972036b",
"index": 11,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Destination Details",
"static": false,
"w": 1,
"x": 0,
"y": 3
},
{
"h": 4,
"i": "3podiwrjhh-bc5306a0-9fdd-11ed-882b-b559788954b9",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Mapped Fields",
"query": "displayMappedFields",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 2,
"x": 1,
"y": 0
},
{
"h": 3,
"i": "3podiwrjhh-5183f540-ab96-11ed-baee-3d8f7e1bb0df",
"items": [
{
"endCol": 2,
"fieldId": "incident_labels",
"height": 26,
"id": "517b1ba0-ab96-11ed-baee-3d8f7e1bb0df",
"index": 0,
"isVisible": true,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Unmapped fields",
"static": false,
"type": "labels",
"w": 2,
"x": 1,
"y": 4
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "3podiwrjhh-1b0aaae0-b73f-11ed-977b-dd8e6ac87856",
"items": [
{
"endCol": 2,
"fieldId": "hostname",
"height": 26,
"id": "886de700-b73f-11ed-977b-dd8e6ac87856",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "localip",
"height": 26,
"id": "3608ea50-b73f-11ed-977b-dd8e6ac87856",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "localport",
"height": 26,
"id": "381423a0-b73f-11ed-977b-dd8e6ac87856",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "username",
"height": 26,
"id": "9dc24820-b777-11ed-8813-5b758e756634",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "emailsender",
"height": 26,
"id": "01033340-b75a-11ed-b1c8-ebf36972036b",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatedby",
"height": 26,
"id": "99158f20-b75a-11ed-b1c8-ebf36972036b",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "initiatormd5",
"height": 26,
"id": "41fb0430-b75b-11ed-b1c8-ebf36972036b",
"index": 7,
"listId": "3podiwrjhh-1b0aaae0-b73f-11ed-977b-dd8e6ac87856",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatorsha256",
"height": 26,
"id": "9d3306a0-b75a-11ed-b1c8-ebf36972036b",
"index": 8,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatorcmd",
"height": 26,
"id": "9f4a4de0-b75a-11ed-b1c8-ebf36972036b",
"index": 9,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Source Details",
"static": false,
"w": 1,
"wrapLabels": true,
"x": 0,
"y": 0
}
],
"showEmptyFields": true,
"type": "custom"
},
{
"hidden": false,
"id": "ne8rnxp0ye",
"name": "Investigation Tools",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
"items": [
{
"args": {
"input": {
"simple": "",
"userMarkedRequired": true
},
"output_key": {
"simple": "fileOutputExtension"
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "d2b5eb10-9a42-11ed-aff5-5d4496197108",
"index": 0,
"listId": "caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
"name": "Set the output extension",
"scriptId": "ChangeContext",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "3d025e80-9b39-11ed-860b-4d504a46d33a",
"index": 1,
"name": "XML to JSON",
"scriptId": "ConvertXmlToJson",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"format": {
"complex": {
"accessor": "",
"filters": [],
"root": "fileOutputExtension",
"transformers": []
},
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "7a924a00-9a42-11ed-aff5-5d4496197108",
"index": 0,
"listId": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
"name": "Convert the file",
"scriptId": "ConvertFile",
"sectionItemType": "button",
"startCol": 1
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "508f4080-9b39-11ed-860b-4d504a46d33a",
"index": 2,
"listId": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
"name": "JSON to CSV",
"scriptId": "JSONtoCSV",
"sectionItemType": "button",
"startCol": 1
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Data Formats",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
"items": [
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "35b03f30-9a44-11ed-aff5-5d4496197108",
"index": 0,
"listId": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
"name": "Base64 decode",
"scriptId": "Base64Decode",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "5cac9020-9a44-11ed-aff5-5d4496197108",
"index": 1,
"listId": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
"name": "Base64 encode",
"scriptId": "Base64EncodeV2",
"sectionItemType": "button",
"startCol": 1
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "En/Decoding",
"static": false,
"w": 1,
"x": 0,
"y": 4
},
{
"description": "",
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "3podiwrjhh-63d041e0-9b38-11ed-860b-4d504a46d33a",
"items": [
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "ca3777a0-9b38-11ed-860b-4d504a46d33a",
"index": 0,
"listId": "3podiwrjhh-63d041e0-9b38-11ed-860b-4d504a46d33a",
"name": "Calculate entropy",
"scriptId": "CalculateEntropy",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "File Analysis",
"static": false,
"w": 1,
"x": 0,
"y": 5
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"items": [
{
"args": {
"server": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "5cbebc90-a16b-11ed-9ca2-fbb17e2c305f",
"index": 0,
"listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"name": "Dig",
"scriptId": "Dig",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "f2142100-9b39-11ed-860b-4d504a46d33a",
"index": 1,
"listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"name": "Reverse IP lookup to host",
"scriptId": "IPToHost",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "60256ce0-9b39-11ed-860b-4d504a46d33a",
"index": 0,
"listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"name": "Check if IP address is in CIDR",
"scriptId": "IsInCidrRanges",
"sectionItemType": "button",
"startCol": 1
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "1f664d40-9b3a-11ed-860b-4d504a46d33a",
"index": 2,
"listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"name": "Expand Shortened URL",
"scriptId": "ResolveShortenedURL",
"sectionItemType": "button",
"startCol": 1
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Network Utils",
"static": false,
"w": 1,
"wrapLabels": false,
"x": 0,
"y": 2
},
{
"description": "When you click a button in this tab - the execution results will be displayed here.\nTo clear this table click “clear results“.",
"h": 8,
"i": "3podiwrjhh-796c1f40-a6d4-11ed-8f16-61aeed0987f5",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Results",
"query": "displayUtilitiesResults",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 2,
"x": 1,
"y": 0
},
{
"description": "Clear the results table",
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-2fabcc30-b1d2-11ed-9b75-f5e3e7c3244c",
"items": [
{
"args": {
"all": {
"simple": "no"
},
"key": {
"complex": {
"accessor": "id",
"filters": [],
"root": "alert",
"transformers": [
{
"args": {
"limit": {
"isContext": false
},
"replaceWith": {
"isContext": false,
"value": {
"simple": "Base64,digresults,EntropyResult,ResolveShortenedURL,Endpoint"
}
},
"toReplace": {
"isContext": true,
"value": {
"simple": "alert.id"
}
}
},
"operator": "replace"
},
{
"args": {
"delimiter": {
"isContext": false,
"value": {
"simple": ","
}
}
},
"operator": "split"
}
]
}
}
},
"buttonClass": "CLEAR",
"dropEffect": "move",
"endCol": 4,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "40ca1f30-b1d2-11ed-9b75-f5e3e7c3244c",
"index": 0,
"listId": "3podiwrjhh-2fabcc30-b1d2-11ed-9b75-f5e3e7c3244c",
"name": "Clear Results",
"scriptId": "DeleteContext",
"sectionItemType": "button",
"startCol": 2
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Clear Results",
"static": false,
"w": 1,
"x": 0,
"y": 6
}
],
"type": "custom"
},
{
"id": "warRoom",
"name": "War Room",
"type": "warRoom"
},
{
"id": "workPlan",
"name": "Work Plan",
"type": "workPlan"
},
{
"id": "canvas",
"name": "Canvas",
"type": "canvas",
"hidden": false
}
]
},
"group": "incident",
"id": "Default",
"name": "Default",
"quickView": {
"sections": [
{
"description": "",
"fields": [
{
"fieldId": "incident_type",
"isVisible": true
},
{
"fieldId": "incident_severity",
"isVisible": true
},
{
"fieldId": "incident_owner",
"isVisible": true
},
{
"fieldId": "incident_dbotstatus",
"isVisible": true
},
{
"fieldId": "incident_sourcebrand",
"isVisible": true
},
{
"fieldId": "incident_sourceinstance",
"isVisible": true
},
{
"fieldId": "incident_playbookid",
"isVisible": true
},
{
"fieldId": "incident_phase",
"isVisible": true
},
{
"fieldId": "incident_roles",
"isVisible": true
}
],
"isVisible": true,
"name": "Basic Information",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "incident_dbotcreated",
"isVisible": true
},
{
"fieldId": "incident_occurred",
"isVisible": true
},
{
"fieldId": "incident_dbotduedate",
"isVisible": true
},
{
"fieldId": "incident_dbotmodified",
"isVisible": true
},
{
"fieldId": "incident_dbottotaltime",
"isVisible": true
}
],
"isVisible": true,
"name": "Timeline Information",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "incident_phonenumber",
"isVisible": true
},
{
"fieldId": "incident_tags",
"isVisible": true
}
],
"isVisible": true,
"name": "Custom Fields",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "incident_labels",
"isVisible": true
}
],
"isVisible": true,
"name": "Labels",
"query": null,
"queryType": "",
"readOnly": true,
"type": "labels"
}
]
},
"system": false,
"version": -1,
"fromVersion": "6.8.0",
"description": "",
"marketplaces": ["marketplacev2", "xpanse"]
}