{
"detailsV2": {
"tabs": [
{
"id": "summary",
"name": "Legacy Summary",
"type": "summary"
},
{
"id": "3podiwrjhh",
"name": "Alert Overview",
"sections": [
{
"displayType": "ROW",
"h": 2,
"i": "3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "timestamp",
"height": 26,
"id": "ca3282e0-ac81-11ed-90e1-81bc84c0d1fb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "alertid",
"height": 26,
"id": "abb90370-2762-11ec-9959-2922ebe0f011",
"index": 1,
"listId": "3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "type",
"height": 26,
"id": "incident-type-field",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "playbookid",
"height": 26,
"id": "incident-playbookId-field",
"index": 3,
"listId": "3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sourcehostname",
"height": 26,
"id": "bfb2d810-2762-11ec-9959-2922ebe0f011",
"index": 4,
"listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceip",
"height": 26,
"id": "c28fb940-2762-11ec-9959-2922ebe0f011",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "severity",
"height": 26,
"id": "incident-severity-field",
"index": 5,
"listId": "3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourcebrand",
"height": 26,
"id": "incident-sourceBrand-field",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceinstance",
"height": 26,
"id": "incident-sourceInstance-field",
"index": 7,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Alert Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"h": 2,
"i": "3podiwrjhh-caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Notes",
"static": false,
"type": "notes",
"w": 1,
"x": 1,
"y": 4
},
{
"displayType": "ROW",
"h": 3,
"i": "3podiwrjhh-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Work Plan",
"static": false,
"type": "workplan",
"w": 1,
"x": 2,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"i": "3podiwrjhh-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "dbotclosed",
"height": 26,
"id": "incident-dbotClosed-field",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closereason",
"height": 26,
"id": "incident-closeReason-field",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closenotes",
"height": 52,
"id": "incident-closeNotes-field",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Closing Information",
"static": false,
"w": 1,
"x": 0,
"y": 4
},
{
"h": 4,
"i": "3podiwrjhh-9e343160-ac82-11ed-90e1-81bc84c0d1fb",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Command and Task Results",
"query": {
"categories": [
"commandAndResults",
"playbookTaskResult",
"playbookTaskStartAndDone",
"playbookErrors"
],
"preDefinedFilters": true,
"tags": []
},
"queryType": "warRoomFilter",
"static": false,
"type": "invTimeline",
"w": 1,
"x": 1,
"y": 0
},
{
"h": 3,
"i": "3podiwrjhh-22ce89f0-b040-11ed-95eb-6fbf73c92c07",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Malicious or Suspicious Indicators",
"query": "reputation:Bad or reputation:Suspicious",
"queryType": "input",
"static": false,
"type": "indicators",
"w": 2,
"x": 0,
"y": 6
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"items": [
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "cabada80-b057-11ed-95eb-6fbf73c92c07",
"index": 0,
"listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"name": "Extract indicators from text file",
"scriptId": "ExtractIndicatorsFromTextFile",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"exclude_TLD": {
"simple": "",
"userMarkedRequired": true
},
"exclude_indicators": {
"simple": "",
"userMarkedRequired": true
},
"unescape_domain": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "cc0ed1c0-b057-11ed-95eb-6fbf73c92c07",
"index": 1,
"listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"name": "Extract indicators from a blog",
"scriptId": "ParseHTMLIndicators",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"using-brand": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "cd789af0-b057-11ed-95eb-6fbf73c92c07",
"index": 2,
"listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"name": "Enrich indicators",
"scriptId": "Builtin|||enrichIndicators",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "199cd250-b055-11ed-95eb-6fbf73c92c07",
"index": 3,
"listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
"name": "Tag Indicators",
"scriptId": "AppendindicatorFieldWrapper",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"comment": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "1760ec10-b055-11ed-95eb-6fbf73c92c07",
"index": 4,
"name": "Block Hash List",
"scriptId": "Cortex Core - IR|||core-blocklist-files",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"comment": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "success",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "18782870-b055-11ed-95eb-6fbf73c92c07",
"index": 5,
"name": "Allow Hash List",
"scriptId": "Cortex Core - IR|||core-allowlist-files",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Indicators Handling",
"static": false,
"w": 1,
"x": 2,
"y": 6
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "3podiwrjhh-c0edb6d0-b1d8-11ed-922b-b50d0a485e48",
"items": [
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "557b46d0-b1db-11ed-922b-b50d0a485e48",
"index": 0,
"name": "Domain Prevalence",
"scriptId": "Cortex Core - IR|||core-get-domain-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "5231c120-b1db-11ed-922b-b50d0a485e48",
"index": 1,
"name": "IP Prevalence",
"scriptId": "Cortex Core - IR|||core-get-IP-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "5359ed70-b1db-11ed-922b-b50d0a485e48",
"index": 2,
"name": "Hash Prevalence",
"scriptId": "Cortex Core - IR|||core-get-hash-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "56c44190-b1db-11ed-922b-b50d0a485e48",
"index": 3,
"name": "Process Prevalence",
"scriptId": "Cortex Core - IR|||core-get-process-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "57db2fd0-b1db-11ed-922b-b50d0a485e48",
"index": 4,
"name": "CMD Prevalence",
"scriptId": "Cortex Core - IR|||core-get-cmd-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "59147320-b1db-11ed-922b-b50d0a485e48",
"index": 5,
"name": "Registry Prevalence",
"scriptId": "Cortex Core - IR|||core-get-registry-analytics-prevalence",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Analytics Prevalence Check",
"static": false,
"w": 1,
"x": 2,
"y": 3
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-68821790-b77b-11ed-a817-f75b1612b8eb",
"items": [
{
"endCol": 2,
"fieldId": "hostname",
"height": 26,
"id": "81791550-b77b-11ed-a817-f75b1612b8eb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "hostip",
"height": 26,
"id": "831d4f70-b77b-11ed-a817-f75b1612b8eb",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "username",
"height": 26,
"id": "88fe9700-b77b-11ed-a817-f75b1612b8eb",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Target Identification",
"static": false,
"w": 1,
"x": 0,
"y": 2
}
],
"showEmptyFields": true,
"type": "custom"
},
{
"hidden": false,
"id": "qil00jt3lr",
"name": "Technical Information",
"sections": [
{
"h": 10,
"i": "3podiwrjhh-bc5306a0-9fdd-11ed-882b-b559788954b9",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Mapped Fields",
"query": "displayMappedFields",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 2,
"y": 0
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "3podiwrjhh-9619ca10-ac7f-11ed-90e1-81bc84c0d1fb",
"items": [
{
"endCol": 2,
"fieldId": "cgoname",
"height": 26,
"id": "bfd7fa20-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "cgopath",
"height": 26,
"id": "c18200a0-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "cgocmd",
"height": 26,
"id": "c43e3a70-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "cgomd5",
"height": 26,
"id": "c5abd430-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "cgosha256",
"height": 26,
"id": "c6ad3ea0-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "cgosignature",
"height": 26,
"id": "c77ceab0-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "cgosigner",
"height": 26,
"id": "c8635310-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 6,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Causality Details",
"static": false,
"w": 1,
"wrapLabels": true,
"x": 1,
"y": 0
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "3podiwrjhh-98e4f800-ac7f-11ed-90e1-81bc84c0d1fb",
"items": [
{
"endCol": 2,
"fieldId": "initiatedby",
"height": 26,
"id": "cfd329e0-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatorpath",
"height": 26,
"id": "d1404e70-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatorcmd",
"height": 26,
"id": "d58c7710-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatorpid",
"height": 26,
"id": "dcaddfc0-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatortid",
"height": 26,
"id": "e32bb570-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatormd5",
"height": 26,
"id": "d6d71f80-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatorsha256",
"height": 26,
"id": "d7ca0b00-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatorsignature",
"height": 26,
"id": "d9106db0-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 7,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "initiatorsigner",
"height": 26,
"id": "da0e7cc0-ac7f-11ed-90e1-81bc84c0d1fb",
"index": 8,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Actor Details",
"static": false,
"w": 1,
"x": 1,
"y": 3
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-9d66d6a0-ac7f-11ed-90e1-81bc84c0d1fb",
"items": [
{
"endCol": 2,
"fieldId": "targetprocessname",
"height": 26,
"id": "07f19e60-ac80-11ed-90e1-81bc84c0d1fb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "targetprocesssha256",
"height": 26,
"id": "0aa8cf20-ac80-11ed-90e1-81bc84c0d1fb",
"index": 1,
"listId": "3podiwrjhh-9d66d6a0-ac7f-11ed-90e1-81bc84c0d1fb",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "targetprocesscmd",
"height": 26,
"id": "09406580-ac80-11ed-90e1-81bc84c0d1fb",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Action Process Details",
"static": false,
"w": 1,
"x": 1,
"y": 6
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-9e99d860-ac7f-11ed-90e1-81bc84c0d1fb",
"items": [
{
"endCol": 2,
"fieldId": "filename",
"height": 26,
"id": "e053e100-b77a-11ed-a817-f75b1612b8eb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filemd5",
"height": 26,
"id": "e597fe30-b77a-11ed-a817-f75b1612b8eb",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filesha256",
"height": 26,
"id": "e75b3200-b77a-11ed-a817-f75b1612b8eb",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filepath",
"height": 26,
"id": "e9b52790-b77a-11ed-a817-f75b1612b8eb",
"index": 3,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Action File Details",
"static": false,
"w": 1,
"x": 1,
"y": 8
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-878d7720-ac80-11ed-90e1-81bc84c0d1fb",
"items": [
{
"endCol": 2,
"fieldId": "localip",
"height": 26,
"id": "3dacd910-ac81-11ed-90e1-81bc84c0d1fb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "localport",
"height": 26,
"id": "3f6e3820-ac81-11ed-90e1-81bc84c0d1fb",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "remoteip",
"height": 26,
"id": "92bb4050-ac80-11ed-90e1-81bc84c0d1fb",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "remoteport",
"height": 26,
"id": "955fd370-ac80-11ed-90e1-81bc84c0d1fb",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "remotehost",
"height": 26,
"id": "9064f440-ac80-11ed-90e1-81bc84c0d1fb",
"index": 4,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Network Details",
"static": false,
"w": 1,
"wrapLabels": false,
"x": 0,
"y": 8
},
{
"displayType": "ROW",
"h": 4,
"hideName": false,
"i": "3podiwrjhh-b5124c20-ac80-11ed-90e1-81bc84c0d1fb",
"items": [
{
"endCol": 2,
"fieldId": "hostname",
"height": 26,
"id": "53619990-ac80-11ed-90e1-81bc84c0d1fb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "hostip",
"height": 26,
"id": "55284fd0-ac80-11ed-90e1-81bc84c0d1fb",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "hostfqdn",
"height": 26,
"id": "57411db0-ac80-11ed-90e1-81bc84c0d1fb",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "hostmacaddress",
"height": 26,
"id": "587a8810-ac80-11ed-90e1-81bc84c0d1fb",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "hostos",
"height": 26,
"id": "ae9ac290-ac81-11ed-90e1-81bc84c0d1fb",
"index": 4,
"listId": "3podiwrjhh-b5124c20-ac80-11ed-90e1-81bc84c0d1fb",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "hostrisklevel",
"height": 26,
"id": "cac64c20-6354-11ee-ae84-23f4070ef7f7",
"index": 5,
"listId": "3podiwrjhh-b5124c20-ac80-11ed-90e1-81bc84c0d1fb",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "hostriskreasons",
"height": 26,
"id": "cdc81a70-6354-11ee-ae84-23f4070ef7f7",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "agentossubtype",
"height": 26,
"id": "bec9f010-ac80-11ed-90e1-81bc84c0d1fb",
"index": 7,
"sectionItemType": "field",
"startCol": 0,
"dropEffect": "move",
"listId": "3podiwrjhh-b5124c20-ac80-11ed-90e1-81bc84c0d1fb"
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "agentid",
"height": 26,
"id": "bd79a250-ac80-11ed-90e1-81bc84c0d1fb",
"index": 8,
"listId": "3podiwrjhh-b5124c20-ac80-11ed-90e1-81bc84c0d1fb",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "agentversion",
"height": 26,
"id": "c54a5dd0-ac80-11ed-90e1-81bc84c0d1fb",
"index": 9,
"sectionItemType": "field",
"startCol": 0
},
{
"args": {
"alias": {
"simple": "",
"userMarkedRequired": true
},
"all": {
"simple": "",
"userMarkedRequired": true
},
"dist_name": {
"simple": "",
"userMarkedRequired": true
},
"endpoint_id_list": {
"simple": "",
"userMarkedRequired": true
},
"group_name": {
"simple": "",
"userMarkedRequired": true
},
"gte_first_seen": {
"simple": "",
"userMarkedRequired": true
},
"gte_last_seen": {
"simple": "",
"userMarkedRequired": true
},
"hostname": {
"simple": "",
"userMarkedRequired": true
},
"ip_list": {
"simple": "",
"userMarkedRequired": true
},
"isolate": {
"simple": "",
"userMarkedRequired": true
},
"lte_first_seen": {
"simple": "",
"userMarkedRequired": true
},
"lte_last_seen": {
"simple": "",
"userMarkedRequired": true
},
"platform": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "81881100-b04a-11ed-95eb-6fbf73c92c07",
"index": 10,
"name": "Choose host to scan",
"scriptId": "Cortex Core - IR|||core-endpoint-scan",
"sectionItemType": "button",
"startCol": 0,
"dropEffect": "move",
"listId": "3podiwrjhh-b5124c20-ac80-11ed-90e1-81bc84c0d1fb"
},
{
"args": {
"alias": {
"simple": "",
"userMarkedRequired": true
},
"all": {
"simple": "",
"userMarkedRequired": true
},
"dist_name": {
"simple": "",
"userMarkedRequired": true
},
"endpoint_id_list": {
"simple": "",
"userMarkedRequired": true
},
"group_name": {
"simple": "",
"userMarkedRequired": true
},
"gte_first_seen": {
"simple": "",
"userMarkedRequired": true
},
"gte_last_seen": {
"simple": "",
"userMarkedRequired": true
},
"hostname": {
"simple": "",
"userMarkedRequired": true
},
"ip_list": {
"simple": "",
"userMarkedRequired": true
},
"isolate": {
"simple": "",
"userMarkedRequired": true
},
"lte_first_seen": {
"simple": "",
"userMarkedRequired": true
},
"lte_last_seen": {
"simple": "",
"userMarkedRequired": true
},
"platform": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "82800590-b04a-11ed-95eb-6fbf73c92c07",
"index": 11,
"name": "Abort host scan",
"scriptId": "Cortex Core - IR|||core-endpoint-scan-abort",
"sectionItemType": "button",
"startCol": 0,
"dropEffect": "move",
"listId": "3podiwrjhh-b5124c20-ac80-11ed-90e1-81bc84c0d1fb"
},
{
"args": {},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "75e16e50-b04a-11ed-95eb-6fbf73c92c07",
"index": 12,
"name": "Choose host to isolate",
"scriptId": "Cortex Core - IR|||core-isolate-endpoint",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "success",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "77403b00-b04a-11ed-95eb-6fbf73c92c07",
"index": 13,
"name": "Choose host to unisolate",
"scriptId": "Cortex Core - IR|||core-unisolate-endpoint",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Host Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "3podiwrjhh-a2fc5df0-b04a-11ed-95eb-6fbf73c92c07",
"items": [
{
"args": {
"generic_file_path": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "1c425e90-b04f-11ed-95eb-6fbf73c92c07",
"index": 0,
"listId": "3podiwrjhh-a2fc5df0-b04a-11ed-95eb-6fbf73c92c07",
"name": "Choose file to retrieve",
"scriptId": "Cortex Core - IR|||core-retrieve-files",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "1dcd4450-b04f-11ed-95eb-6fbf73c92c07",
"index": 1,
"listId": "3podiwrjhh-a2fc5df0-b04a-11ed-95eb-6fbf73c92c07",
"name": "Check file existence",
"scriptId": "Cortex Core - IR|||core-run-script-file-exists",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "16dc8890-b04f-11ed-95eb-6fbf73c92c07",
"index": 2,
"name": "Choose file to delete",
"scriptId": "Cortex Core - IR|||core-run-script-delete-file",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "error",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "1887c790-b04f-11ed-95eb-6fbf73c92c07",
"index": 3,
"name": "Choose file to quarantine",
"scriptId": "Cortex Core - IR|||core-quarantine-files",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "error",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "84fa8930-b04f-11ed-95eb-6fbf73c92c07",
"index": 4,
"listId": "3podiwrjhh-a2fc5df0-b04a-11ed-95eb-6fbf73c92c07",
"name": "Choose process to kill",
"scriptId": "Cortex Core - IR|||core-run-script-kill-process",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "success",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "1a75b4e0-b04f-11ed-95eb-6fbf73c92c07",
"index": 5,
"name": "Choose file to restore",
"scriptId": "Cortex Core - IR|||core-restore-file",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "File and Process Remediation",
"static": false,
"w": 1,
"x": 0,
"y": 4
},
{
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "3podiwrjhh-a4c6b620-b77b-11ed-a817-f75b1612b8eb",
"items": [
{
"endCol": 2,
"fieldId": "username",
"height": 26,
"id": "b252baa0-b77b-11ed-a817-f75b1612b8eb",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "userrisklevel",
"height": 26,
"id": "ddd376d0-6354-11ee-ae84-23f4070ef7f7",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "userriskreasons",
"height": 26,
"id": "df6ab8a0-6354-11ee-ae84-23f4070ef7f7",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Account Details",
"static": false,
"w": 1,
"x": 0,
"y": 7
}
],
"showEmptyFields": true,
"type": "custom"
},
{
"hidden": false,
"id": "ne8rnxp0ye",
"name": "Investigation Tools",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
"items": [
{
"args": {
"input": {
"simple": "",
"userMarkedRequired": true
},
"output_key": {
"simple": "fileOutputExtension"
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "d2b5eb10-9a42-11ed-aff5-5d4496197108",
"index": 0,
"listId": "caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
"name": "Set the output extension",
"scriptId": "ChangeContext",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "3d025e80-9b39-11ed-860b-4d504a46d33a",
"index": 1,
"name": "XML to JSON",
"scriptId": "ConvertXmlToJson",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"format": {
"complex": {
"accessor": "",
"filters": [],
"root": "fileOutputExtension",
"transformers": []
},
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "7a924a00-9a42-11ed-aff5-5d4496197108",
"index": 0,
"listId": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
"name": "Convert the file",
"scriptId": "ConvertFile",
"sectionItemType": "button",
"startCol": 1
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "508f4080-9b39-11ed-860b-4d504a46d33a",
"index": 2,
"listId": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
"name": "JSON to CSV",
"scriptId": "JSONtoCSV",
"sectionItemType": "button",
"startCol": 1
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Data Formats",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
"items": [
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "35b03f30-9a44-11ed-aff5-5d4496197108",
"index": 0,
"listId": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
"name": "Base64 decode",
"scriptId": "Base64Decode",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "5cac9020-9a44-11ed-aff5-5d4496197108",
"index": 1,
"listId": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
"name": "Base64 encode",
"scriptId": "Base64EncodeV2",
"sectionItemType": "button",
"startCol": 1
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Decoding and Encoding",
"static": false,
"w": 1,
"x": 0,
"y": 4
},
{
"description": "",
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "3podiwrjhh-63d041e0-9b38-11ed-860b-4d504a46d33a",
"items": [
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "ca3777a0-9b38-11ed-860b-4d504a46d33a",
"index": 0,
"listId": "3podiwrjhh-63d041e0-9b38-11ed-860b-4d504a46d33a",
"name": "Calculate entropy",
"scriptId": "CalculateEntropy",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "File Analysis",
"static": false,
"w": 1,
"x": 0,
"y": 5
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"items": [
{
"args": {
"server": {
"simple": "",
"userMarkedRequired": true
}
},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "5cbebc90-a16b-11ed-9ca2-fbb17e2c305f",
"index": 0,
"listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"name": "Dig / nslookup",
"scriptId": "Dig",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 1,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "f2142100-9b39-11ed-860b-4d504a46d33a",
"index": 1,
"listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"name": "Reverse IP lookup to host",
"scriptId": "IPToHost",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "60256ce0-9b39-11ed-860b-4d504a46d33a",
"index": 0,
"listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"name": "Check if IP address is in CIDR",
"scriptId": "IsInCidrRanges",
"sectionItemType": "button",
"startCol": 1
},
{
"args": {},
"buttonClass": "secondary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "1f664d40-9b3a-11ed-860b-4d504a46d33a",
"index": 2,
"listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
"name": "Expand shortened URL",
"scriptId": "ResolveShortenedURL",
"sectionItemType": "button",
"startCol": 1
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Network Utils",
"static": false,
"w": 1,
"wrapLabels": false,
"x": 0,
"y": 2
},
{
"description": "When you click a button in this tab - the execution results will be displayed here.\nTo clear this table click \u201cclear results\u201c.",
"h": 8,
"i": "3podiwrjhh-796c1f40-a6d4-11ed-8f16-61aeed0987f5",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Results",
"query": "displayUtilitiesResults",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 2,
"x": 1,
"y": 0
},
{
"description": "Clear the results table",
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "3podiwrjhh-2fabcc30-b1d2-11ed-9b75-f5e3e7c3244c",
"items": [
{
"args": {
"all": {
"simple": "no"
},
"key": {
"complex": {
"accessor": "id",
"filters": [],
"root": "alert",
"transformers": [
{
"args": {
"limit": {
"isContext": false
},
"replaceWith": {
"isContext": false,
"value": {
"simple": "Base64,digresults,EntropyResult,ResolveShortenedURL,Endpoint"
}
},
"toReplace": {
"isContext": true,
"value": {
"simple": "alert.id"
}
}
},
"operator": "replace"
},
{
"args": {
"delimiter": {
"isContext": false,
"value": {
"simple": ","
}
}
},
"operator": "split"
}
]
}
}
},
"buttonClass": "CLEAR",
"dropEffect": "move",
"endCol": 4,
"fieldId": "",
"height": 44,
"hexColor": null,
"id": "40ca1f30-b1d2-11ed-9b75-f5e3e7c3244c",
"index": 0,
"listId": "3podiwrjhh-2fabcc30-b1d2-11ed-9b75-f5e3e7c3244c",
"name": "Clear Results",
"scriptId": "DeleteContext",
"sectionItemType": "button",
"startCol": 2
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Clear Results",
"static": false,
"w": 1,
"x": 0,
"y": 6
}
],
"type": "custom"
},
{
"id": "warRoom",
"name": "War Room",
"type": "warRoom"
},
{
"id": "workPlan",
"name": "Work Plan",
"type": "workPlan"
},
{
"id": "canvas",
"name": "Canvas",
"type": "canvas",
"hidden": false
}
]
},
"group": "incident",
"id": "Default XDR Alert",
"name": "Default XDR Alert",
"quickView": {
"sections": [
{
"description": "",
"fields": [
{
"fieldId": "incident_type",
"isVisible": true
},
{
"fieldId": "incident_severity",
"isVisible": true
},
{
"fieldId": "incident_owner",
"isVisible": true
},
{
"fieldId": "incident_dbotstatus",
"isVisible": true
},
{
"fieldId": "incident_sourcebrand",
"isVisible": true
},
{
"fieldId": "incident_sourceinstance",
"isVisible": true
},
{
"fieldId": "incident_playbookid",
"isVisible": true
},
{
"fieldId": "incident_phase",
"isVisible": true
},
{
"fieldId": "incident_roles",
"isVisible": true
}
],
"isVisible": true,
"name": "Basic Information",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "incident_dbotcreated",
"isVisible": true
},
{
"fieldId": "incident_occurred",
"isVisible": true
},
{
"fieldId": "incident_dbotduedate",
"isVisible": true
},
{
"fieldId": "incident_dbotmodified",
"isVisible": true
},
{
"fieldId": "incident_dbottotaltime",
"isVisible": true
}
],
"isVisible": true,
"name": "Timeline Information",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "incident_phonenumber",
"isVisible": true
}
],
"isVisible": true,
"name": "Custom Fields",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "incident_labels",
"isVisible": true
}
],
"isVisible": true,
"name": "Labels",
"query": null,
"queryType": "",
"readOnly": true,
"type": "labels"
}
]
},
"system": false,
"version": -1,
"fromVersion": "6.8.0",
"description": ""
}