Default XDR Alert

Core Incident

Details

IDDefault XDR Alert
Groupincident
Version-1
From Version6.8.0

Layout Structure

Legacy Summary 0 sections

No sections defined.

Alert Overview 9 sections

Alert Details

Field IDPosition
timestamp Col 0-2, Height: 26
alertid Col 0-2, Height: 26
type Col 0-2, Height: 26
playbookid Col 0-2, Height: 26
sourcehostname Col 0-2, Height: 26
sourceip Col 0-2, Height: 26
severity Col 0-2, Height: 26
sourcebrand Col 0-2, Height: 26
sourceinstance Col 0-2, Height: 26

Notes

Work Plan

Closing Information

Field IDPosition
dbotclosed Col 0-2, Height: 26
closereason Col 0-2, Height: 26
closenotes Col 0-2, Height: 52

Command and Task Results

Malicious or Suspicious Indicators

Indicators Handling

Field IDPosition
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44

Analytics Prevalence Check

Field IDPosition
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44

Target Identification

Field IDPosition
hostname Col 0-2, Height: 26
hostip Col 0-2, Height: 26
username Col 0-2, Height: 26
Technical Information 9 sections

Mapped Fields

Causality Details

Field IDPosition
cgoname Col 0-2, Height: 26
cgopath Col 0-2, Height: 26
cgocmd Col 0-2, Height: 26
cgomd5 Col 0-2, Height: 26
cgosha256 Col 0-2, Height: 26
cgosignature Col 0-2, Height: 26
cgosigner Col 0-2, Height: 26

Actor Details

Field IDPosition
initiatedby Col 0-2, Height: 26
initiatorpath Col 0-2, Height: 26
initiatorcmd Col 0-2, Height: 26
initiatorpid Col 0-2, Height: 26
initiatortid Col 0-2, Height: 26
initiatormd5 Col 0-2, Height: 26
initiatorsha256 Col 0-2, Height: 26
initiatorsignature Col 0-2, Height: 26
initiatorsigner Col 0-2, Height: 26

Action Process Details

Field IDPosition
targetprocessname Col 0-2, Height: 26
targetprocesssha256 Col 0-2, Height: 26
targetprocesscmd Col 0-2, Height: 26

Action File Details

Field IDPosition
filename Col 0-2, Height: 26
filemd5 Col 0-2, Height: 26
filesha256 Col 0-2, Height: 26
filepath Col 0-2, Height: 26

Network Details

Field IDPosition
localip Col 0-2, Height: 26
localport Col 0-2, Height: 26
remoteip Col 0-2, Height: 26
remoteport Col 0-2, Height: 26
remotehost Col 0-2, Height: 26

Host Details

Field IDPosition
hostname Col 0-2, Height: 26
hostip Col 0-2, Height: 26
hostfqdn Col 0-2, Height: 26
hostmacaddress Col 0-2, Height: 26
hostos Col 0-2, Height: 26
hostrisklevel Col 0-2, Height: 26
hostriskreasons Col 0-2, Height: 26
agentossubtype Col 0-2, Height: 26
agentid Col 0-2, Height: 26
agentversion Col 0-2, Height: 26
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44

File and Process Remediation

Field IDPosition
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44

Account Details

Field IDPosition
username Col 0-2, Height: 26
userrisklevel Col 0-2, Height: 26
userriskreasons Col 0-2, Height: 26
Investigation Tools 6 sections

Data Formats

Field IDPosition
— Col 0-1, Height: 44
— Col 0-1, Height: 44
— Col 1-2, Height: 44
— Col 1-2, Height: 44

Decoding and Encoding

Field IDPosition
— Col 0-1, Height: 44
— Col 1-2, Height: 44

File Analysis

Field IDPosition
— Col 0-1, Height: 44

Network Utils

Field IDPosition
— Col 0-1, Height: 44
— Col 0-1, Height: 44
— Col 1-2, Height: 44
— Col 1-2, Height: 44

Results

When you click a button in this tab - the execution results will be displayed here. To clear this table click “clear results“.

Clear Results

Clear the results table

Field IDPosition
— Col 2-4, Height: 44
War Room 0 sections

No sections defined.

Work Plan 0 sections

No sections defined.

Canvas 0 sections

No sections defined.