Default

Core Incident

Details

IDDefault
Groupincident
Version-1
From Version6.8.0

Layout Structure

Legacy Summary 0 sections

No sections defined.

Alert Overview 9 sections

Alert Details

Field IDPosition
timestamp Col 0-2, Height: 26
alertid Col 0-2, Height: 26
type Col 0-2, Height: 26
playbookid Col 0-2, Height: 26
sourcehostname Col 0-2, Height: 26
sourceip Col 0-2, Height: 26
severity Col 0-2, Height: 26
sourcebrand Col 0-2, Height: 26
sourceinstance Col 0-2, Height: 26

Notes

Work Plan

Closing Information

Field IDPosition
dbotclosed Col 0-2, Height: 26
closereason Col 0-2, Height: 26
closenotes Col 0-2, Height: 52

Command and Task Results

Malicious or Suspicious Indicators

Indicators Handling

Field IDPosition
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44

Analytics Prevalence Check

Field IDPosition
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44
— Col 0-2, Height: 44

Target Identification

Field IDPosition
hostname Col 0-2, Height: 26
hostip Col 0-2, Height: 26
username Col 0-2, Height: 26
Technical Information 4 sections

Destination Details

Field IDPosition
agent_ip_addresses Col 0-2, Height: 26
remotehost Col 0-2, Height: 26
remoteip Col 0-2, Height: 26
remoteport Col 0-2, Height: 26
emailrecipient Col 0-2, Height: 26
targetprocessname Col 0-2, Height: 26
targetprocesssha256 Col 0-2, Height: 26
targetprocesscmd Col 0-2, Height: 26
filename Col 0-2, Height: 26
filemd5 Col 0-2, Height: 26
filesha256 Col 0-2, Height: 26
filepath Col 0-2, Height: 26

Mapped Fields

Unmapped fields

Field IDPosition
incident_labels Col 0-2, Height: 26

Source Details

Field IDPosition
hostname Col 0-2, Height: 26
localip Col 0-2, Height: 26
localport Col 0-2, Height: 26
username Col 0-2, Height: 26
emailsender Col 0-2, Height: 26
initiatedby Col 0-2, Height: 26
initiatormd5 Col 0-2, Height: 26
initiatorsha256 Col 0-2, Height: 26
initiatorcmd Col 0-2, Height: 26
Investigation Tools 6 sections

Data Formats

Field IDPosition
— Col 0-1, Height: 44
— Col 0-1, Height: 44
— Col 1-2, Height: 44
— Col 1-2, Height: 44

En/Decoding

Field IDPosition
— Col 0-1, Height: 44
— Col 1-2, Height: 44

File Analysis

Field IDPosition
— Col 0-1, Height: 44

Network Utils

Field IDPosition
— Col 0-1, Height: 44
— Col 0-1, Height: 44
— Col 1-2, Height: 44
— Col 1-2, Height: 44

Results

When you click a button in this tab - the execution results will be displayed here. To clear this table click “clear results“.

Clear Results

Clear the results table

Field IDPosition
— Col 2-4, Height: 44
War Room 0 sections

No sections defined.

Work Plan 0 sections

No sections defined.

Canvas 0 sections

No sections defined.

Source

layoutscontainer-Default.json layoutscontainer-Default_XDR_Alert.json layoutscontainer-Default_platform_issues.json
Download History Raw 
{
    "detailsV2": {
        "tabs": [
            {
                "id": "summary",
                "name": "Legacy Summary",
                "type": "summary"
            },
            {
                "id": "warRoom",
                "name": "War Room",
                "type": "warRoom"
            },
            {
                "id": "workPlan",
                "name": "Work Plan",
                "type": "workPlan"
            },
            {
                "id": "canvas",
                "name": "Canvas",
                "type": "canvas",
                "hidden": false
            }
        ]
    },
    "group": "incident",
    "id": "Default",
    "name": "Default",
    "quickView": {
        "sections": [
            {
                "description": "",
                "fields": [
                    {
                        "fieldId": "incident_type",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_severity",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_owner",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_dbotstatus",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_sourcebrand",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_sourceinstance",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_playbookid",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_phase",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_roles",
                        "isVisible": true
                    }
                ],
                "isVisible": true,
                "name": "Basic Information",
                "query": null,
                "queryType": "",
                "readOnly": false,
                "type": ""
            },
            {
                "description": "",
                "fields": [
                    {
                        "fieldId": "incident_dbotcreated",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_occurred",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_dbotduedate",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_dbotmodified",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_dbottotaltime",
                        "isVisible": true
                    }
                ],
                "isVisible": true,
                "name": "Timeline Information",
                "query": null,
                "queryType": "",
                "readOnly": false,
                "type": ""
            },
            {
                "description": "",
                "fields": [
                    {
                        "fieldId": "incident_phonenumber",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_tags",
                        "isVisible": true
                    }
                ],
                "isVisible": true,
                "name": "Custom Fields",
                "query": null,
                "queryType": "",
                "readOnly": false,
                "type": ""
            },
            {
                "description": "",
                "fields": [
                    {
                        "fieldId": "incident_labels",
                        "isVisible": true
                    }
                ],
                "isVisible": true,
                "name": "Labels",
                "query": null,
                "queryType": "",
                "readOnly": true,
                "type": "labels"
            }
        ]
    },
    "system": false,
    "version": -1,
    "fromVersion": "6.8.0",
    "description": "",
    "marketplaces": [
        "platform"
    ]
}