Identity Analytics Alerts

Core Incident

Details

IDIdentity Analytics Alerts
Groupincident
Version-1
From Version6.10.0

Layout Structure

Legacy Summary 0 sections

No sections defined.

Alert Overview 7 sections

Alert Details

Field IDPosition
details Col 0-2, Height: 52
timestamp Col 0-2, Height: 26
type Col 0-2, Height: 26
playbookid Col 0-2, Height: 26
severity Col 0-2, Height: 26
sourcebrand Col 0-2, Height: 26
tags Col 0-2, Height: 26
sourceip Col 0-2, Height: 26
mitreattcktactic Col 0-2, Height: 26
mitreattcktechnique Col 0-2, Height: 26

Work Plan

Closing Information

Field IDPosition
dbotclosed Col 0-2, Height: 26
closereason Col 0-2, Height: 26
closenotes Col 0-2, Height: 52

Indicators Handling

Field IDPosition
Col 0-2, Height: 44
Col 0-2, Height: 44

Analytics Prevalence Check

Field IDPosition
Col 0-2, Height: 44
Col 0-2, Height: 44

Identity Details

Field IDPosition
username Col 0-2, Height: 26
samaccountname Col 0-2, Height: 26
accountstatus Col 0-2, Height: 26
email Col 0-2, Height: 26
accountmemberof Col 0-2, Height: 26
cloudaccountid Col 0-2, Height: 26
accountid Col 0-2, Height: 26
manageremailaddress Col 0-2, Height: 26

Response Actions

Field IDPosition
Col 0-2, Height: 44
Col 0-2, Height: 44
Col 0-2, Height: 44
Col 0-2, Height: 44
Technical Information 5 sections

Mapped Fields

Found Related Alerts

Additional Found alerts by Mitre tactics related to the user.

Field IDPosition
alertsearchresults Col 0-6, Height: 106

Investigation Results

Field IDPosition
numberoffoundrelatedalerts Col 0-2, Height: 53
failedlogonevents Col 0-2, Height: 53
userrisklevel Col 0-2, Height: 53

Investigation Verdict

Malicious or Suspicious Indicators

Investigation Tools 6 sections

Data Formats

Field IDPosition
Col 0-1, Height: 44
Col 0-1, Height: 44
Col 1-2, Height: 44
Col 1-2, Height: 44

En/Decoding

Field IDPosition
Col 0-1, Height: 44
Col 1-2, Height: 44

File Analysis

Field IDPosition
Col 0-1, Height: 44

Network Utils

Field IDPosition
Col 0-1, Height: 44
Col 0-1, Height: 44
Col 1-2, Height: 44
Col 1-2, Height: 44

Results

When you click a button in this tab - the execution results will be displayed here. To clear this table click “clear results“.

Clear Results

Clear the results table

Field IDPosition
Col 2-4, Height: 44
War Room 0 sections

No sections defined.

Work Plan 0 sections

No sections defined.

Canvas 0 sections

No sections defined.

{
    "detailsV2": {
        "tabs": [
            {
                "id": "summary",
                "name": "Legacy Summary",
                "type": "summary"
            },
            {
                "id": "w68olunplf",
                "name": "Alert Overview",
                "sections": [
                    {
                        "displayType": "ROW",
                        "h": 4,
                        "i": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
                        "isVisible": true,
                        "items": [
                            {
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "details",
                                "height": 52,
                                "id": "454bde00-98d5-11ee-a5aa-39f0d8c6d1cc",
                                "index": 0,
                                "listId": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "timestamp",
                                "height": 26,
                                "id": "ca3282e0-ac81-11ed-90e1-81bc84c0d1fb",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "type",
                                "height": 26,
                                "id": "incident-type-field",
                                "index": 3,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "playbookid",
                                "height": 26,
                                "id": "incident-playbookId-field",
                                "index": 4,
                                "listId": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "severity",
                                "height": 26,
                                "id": "incident-severity-field",
                                "index": 5,
                                "listId": "3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sourcebrand",
                                "height": 26,
                                "id": "incident-sourceBrand-field",
                                "index": 6,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "tags",
                                "height": 26,
                                "id": "10f0cfa0-9810-11ee-99ee-4be4f8dc69b3",
                                "index": 7,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sourceip",
                                "height": 26,
                                "id": "c28fb940-2762-11ec-9959-2922ebe0f011",
                                "index": 8,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "mitreattcktactic",
                                "height": 26,
                                "id": "6bd5e520-98d5-11ee-a5aa-39f0d8c6d1cc",
                                "index": 9,
                                "listId": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "mitreattcktechnique",
                                "height": 26,
                                "id": "769a1710-98d5-11ee-a5aa-39f0d8c6d1cc",
                                "index": 10,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Alert Details",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 0
                    },
                    {
                        "displayType": "ROW",
                        "h": 4,
                        "i": "w68olunplf-3podiwrjhh-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8",
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Work Plan",
                        "static": false,
                        "type": "workplan",
                        "w": 1,
                        "x": 1,
                        "y": 0
                    },
                    {
                        "displayType": "ROW",
                        "h": 3,
                        "i": "w68olunplf-3podiwrjhh-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289",
                        "isVisible": true,
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "dbotclosed",
                                "height": 26,
                                "id": "incident-dbotClosed-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "closereason",
                                "height": 26,
                                "id": "incident-closeReason-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "closenotes",
                                "height": 52,
                                "id": "incident-closeNotes-field",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Closing Information",
                        "static": false,
                        "w": 1,
                        "x": 1,
                        "y": 4
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "w68olunplf-3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
                        "items": [
                            {
                                "args": {
                                    "using-brand": {
                                        "simple": "",
                                        "userMarkedRequired": true
                                    }
                                },
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "cd789af0-b057-11ed-95eb-6fbf73c92c07",
                                "index": 0,
                                "listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
                                "name": "Enrich indicators",
                                "scriptId": "Builtin|||enrichIndicators",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "199cd250-b055-11ed-95eb-6fbf73c92c07",
                                "index": 1,
                                "listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07",
                                "name": "Tag Indicators",
                                "scriptId": "AppendindicatorFieldWrapper",
                                "sectionItemType": "button",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Indicators Handling",
                        "static": false,
                        "w": 1,
                        "x": 2,
                        "y": 5
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "w68olunplf-3podiwrjhh-c0edb6d0-b1d8-11ed-922b-b50d0a485e48",
                        "items": [
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "5231c120-b1db-11ed-922b-b50d0a485e48",
                                "index": 0,
                                "name": "IP Prevalence",
                                "scriptId": "Cortex Core - IR|||core-get-IP-analytics-prevalence",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "57db2fd0-b1db-11ed-922b-b50d0a485e48",
                                "index": 1,
                                "name": "User Prevalence",
                                "scriptId": "DisableUserWrapper",
                                "sectionItemType": "button",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Analytics Prevalence Check",
                        "static": false,
                        "w": 1,
                        "x": 2,
                        "y": 3
                    },
                    {
                        "displayType": "ROW",
                        "h": 3,
                        "hideName": false,
                        "i": "w68olunplf-3podiwrjhh-68821790-b77b-11ed-a817-f75b1612b8eb",
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "username",
                                "height": 26,
                                "id": "88fe9700-b77b-11ed-a817-f75b1612b8eb",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "samaccountname",
                                "height": 26,
                                "id": "30c1b470-98ce-11ee-8aac-c7473a83f305",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "accountstatus",
                                "height": 26,
                                "id": "38a50d90-98ce-11ee-8aac-c7473a83f305",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "email",
                                "height": 26,
                                "id": "4d3ebd00-9810-11ee-99ee-4be4f8dc69b3",
                                "index": 3,
                                "listId": "w68olunplf-3podiwrjhh-68821790-b77b-11ed-a817-f75b1612b8eb",
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "accountmemberof",
                                "height": 26,
                                "id": "06c05890-9818-11ee-99ee-4be4f8dc69b3",
                                "index": 4,
                                "listId": "w68olunplf-3podiwrjhh-68821790-b77b-11ed-a817-f75b1612b8eb",
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "cloudaccountid",
                                "height": 26,
                                "id": "593a3cd0-9818-11ee-99ee-4be4f8dc69b3",
                                "index": 5,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "accountid",
                                "height": 26,
                                "id": "d6fc9860-98cd-11ee-8aac-c7473a83f305",
                                "index": 6,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "manageremailaddress",
                                "height": 26,
                                "id": "2ef1f0f0-98e3-11ee-a5aa-39f0d8c6d1cc",
                                "index": 7,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Identity Details",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 4
                    },
                    {
                        "displayType": "ROW",
                        "h": 3,
                        "hideName": false,
                        "i": "w68olunplf-a0a75d10-98cb-11ee-8aac-c7473a83f305",
                        "items": [
                            {
                                "args": {},
                                "buttonClass": "error",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "58c9e200-98cc-11ee-8aac-c7473a83f305",
                                "index": 0,
                                "name": "Clear User's Sessions - Okta ",
                                "scriptId": "Okta v2|||okta-clear-user-sessions",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "error",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "5ed87b20-98cc-11ee-8aac-c7473a83f305",
                                "index": 1,
                                "listId": "w68olunplf-a0a75d10-98cb-11ee-8aac-c7473a83f305",
                                "name": "Revoke User's Sessions - Azure",
                                "scriptId": "Microsoft Graph User|||msgraph-user-session-revoke",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "error",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "af5e7ea0-98cc-11ee-8aac-c7473a83f305",
                                "index": 2,
                                "listId": "w68olunplf-a0a75d10-98cb-11ee-8aac-c7473a83f305",
                                "name": "Reset Password - Active Directory",
                                "scriptId": "Active Directory Query v2|||ad-set-new-password",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "error",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "af5e7ea0-98cc-11ee-8aac-c7473a83f305",
                                "index": 3,
                                "listId": "w68olunplf-a0a75d10-98cb-11ee-8aac-c7473a83f305",
                                "name": "Disable Account",
                                "scriptId": "DisableUserWrapper",
                                "sectionItemType": "button",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Response Actions",
                        "static": false,
                        "w": 1,
                        "x": 2,
                        "y": 0
                    }
                ],
                "showEmptyFields": true,
                "type": "custom"
            },
            {
                "hidden": false,
                "id": "xxtngoiqpq",
                "name": "Technical Information",
                "sections": [
                    {
                        "h": 8,
                        "i": "w68olunplf-3podiwrjhh-bc5306a0-9fdd-11ed-882b-b559788954b9",
                        "items": [],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Mapped Fields",
                        "query": "displayMappedFields",
                        "queryType": "script",
                        "static": false,
                        "type": "dynamic",
                        "w": 1,
                        "x": 2,
                        "y": 0
                    },
                    {
                        "description": "Additional Found alerts by Mitre tactics related to the user.",
                        "displayType": "ROW",
                        "h": 3,
                        "hideName": false,
                        "i": "w68olunplf-86548370-9808-11ee-b83f-43a8d6b51fe8",
                        "items": [
                            {
                                "dropEffect": "move",
                                "endCol": 6,
                                "fieldId": "alertsearchresults",
                                "height": 106,
                                "id": "924379c0-9808-11ee-b83f-43a8d6b51fe8",
                                "index": 0,
                                "listId": "w68olunplf-86548370-9808-11ee-b83f-43a8d6b51fe8",
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Found Related Alerts",
                        "static": false,
                        "w": 2,
                        "x": 0,
                        "y": 2
                    },
                    {
                        "displayType": "CARD",
                        "h": 2,
                        "hideName": false,
                        "i": "w68olunplf-9915bec0-980d-11ee-99ee-4be4f8dc69b3",
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "numberoffoundrelatedalerts",
                                "height": 53,
                                "id": "ca488090-980d-11ee-99ee-4be4f8dc69b3",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "failedlogonevents",
                                "height": 53,
                                "id": "e8499fc0-980d-11ee-99ee-4be4f8dc69b3",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "userrisklevel",
                                "height": 53,
                                "id": "dcabafa0-980d-11ee-99ee-4be4f8dc69b3",
                                "index": 2,
                                "listId": "w68olunplf-9915bec0-980d-11ee-99ee-4be4f8dc69b3",
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Investigation Results",
                        "static": false,
                        "w": 1,
                        "x": 1,
                        "y": 0
                    },
                    {
                        "h": 2,
                        "i": "w68olunplf-05a38270-980e-11ee-99ee-4be4f8dc69b3",
                        "items": [],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Investigation Verdict",
                        "query": "VerdictResult",
                        "queryType": "script",
                        "static": false,
                        "type": "dynamic",
                        "w": 1,
                        "x": 0,
                        "y": 0
                    },
                    {
                        "h": 3,
                        "i": "w68olunplf-6ee6cfe0-982b-11ee-9d69-eb396ec63adf",
                        "items": [],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Malicious or Suspicious Indicators",
                        "query": "reputation:Bad or reputation:Suspicious",
                        "queryType": "input",
                        "static": false,
                        "type": "indicators",
                        "w": 2,
                        "x": 0,
                        "y": 5
                    }
                ],
                "showEmptyFields": true,
                "type": "custom"
            },
            {
                "hidden": false,
                "id": "ne8rnxp0ye",
                "name": "Investigation Tools",
                "sections": [
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
                        "items": [
                            {
                                "args": {
                                    "input": {
                                        "simple": "",
                                        "userMarkedRequired": true
                                    },
                                    "output_key": {
                                        "simple": "fileOutputExtension"
                                    }
                                },
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 1,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "d2b5eb10-9a42-11ed-aff5-5d4496197108",
                                "index": 0,
                                "listId": "caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
                                "name": "Set the output extension",
                                "scriptId": "ChangeContext",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "endCol": 1,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "3d025e80-9b39-11ed-860b-4d504a46d33a",
                                "index": 1,
                                "name": "XML to JSON",
                                "scriptId": "ConvertXmlToJson",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {
                                    "format": {
                                        "complex": {
                                            "accessor": "",
                                            "filters": [],
                                            "root": "fileOutputExtension",
                                            "transformers": []
                                        },
                                        "userMarkedRequired": true
                                    }
                                },
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "7a924a00-9a42-11ed-aff5-5d4496197108",
                                "index": 0,
                                "listId": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
                                "name": "Convert the file",
                                "scriptId": "ConvertFile",
                                "sectionItemType": "button",
                                "startCol": 1
                            },
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "508f4080-9b39-11ed-860b-4d504a46d33a",
                                "index": 2,
                                "listId": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108",
                                "name": "JSON to CSV",
                                "scriptId": "JSONtoCSV",
                                "sectionItemType": "button",
                                "startCol": 1
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Data Formats",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 0
                    },
                    {
                        "displayType": "ROW",
                        "h": 1,
                        "hideName": false,
                        "i": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
                        "items": [
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 1,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "35b03f30-9a44-11ed-aff5-5d4496197108",
                                "index": 0,
                                "listId": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
                                "name": "Base64 decode",
                                "scriptId": "Base64Decode",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "5cac9020-9a44-11ed-aff5-5d4496197108",
                                "index": 1,
                                "listId": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108",
                                "name": "Base64 encode",
                                "scriptId": "Base64EncodeV2",
                                "sectionItemType": "button",
                                "startCol": 1
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "En/Decoding",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 4
                    },
                    {
                        "description": "",
                        "displayType": "ROW",
                        "h": 1,
                        "hideName": false,
                        "i": "3podiwrjhh-63d041e0-9b38-11ed-860b-4d504a46d33a",
                        "items": [
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 1,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "ca3777a0-9b38-11ed-860b-4d504a46d33a",
                                "index": 0,
                                "listId": "3podiwrjhh-63d041e0-9b38-11ed-860b-4d504a46d33a",
                                "name": "Calculate entropy",
                                "scriptId": "CalculateEntropy",
                                "sectionItemType": "button",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "File Analysis",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 5
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
                        "items": [
                            {
                                "args": {
                                    "server": {
                                        "simple": "",
                                        "userMarkedRequired": true
                                    }
                                },
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 1,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "5cbebc90-a16b-11ed-9ca2-fbb17e2c305f",
                                "index": 0,
                                "listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
                                "name": "Dig",
                                "scriptId": "Dig",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 1,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "f2142100-9b39-11ed-860b-4d504a46d33a",
                                "index": 1,
                                "listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
                                "name": "Reverse IP lookup to host",
                                "scriptId": "IPToHost",
                                "sectionItemType": "button",
                                "startCol": 0
                            },
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "60256ce0-9b39-11ed-860b-4d504a46d33a",
                                "index": 0,
                                "listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
                                "name": "Check if IP address is in CIDR",
                                "scriptId": "IsInCidrRanges",
                                "sectionItemType": "button",
                                "startCol": 1
                            },
                            {
                                "args": {},
                                "buttonClass": "secondary",
                                "dropEffect": "move",
                                "endCol": 2,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "1f664d40-9b3a-11ed-860b-4d504a46d33a",
                                "index": 2,
                                "listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a",
                                "name": "Expand Shortened URL",
                                "scriptId": "ResolveShortenedURL",
                                "sectionItemType": "button",
                                "startCol": 1
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Network Utils",
                        "static": false,
                        "w": 1,
                        "wrapLabels": false,
                        "x": 0,
                        "y": 2
                    },
                    {
                        "description": "When you click a button in this tab - the execution results will be displayed here.\nTo clear this table click \u201cclear results\u201c.",
                        "h": 8,
                        "i": "3podiwrjhh-796c1f40-a6d4-11ed-8f16-61aeed0987f5",
                        "items": [],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Results",
                        "query": "displayUtilitiesResults",
                        "queryType": "script",
                        "static": false,
                        "type": "dynamic",
                        "w": 2,
                        "x": 1,
                        "y": 0
                    },
                    {
                        "description": "Clear the results table",
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "3podiwrjhh-2fabcc30-b1d2-11ed-9b75-f5e3e7c3244c",
                        "items": [
                            {
                                "args": {
                                    "all": {
                                        "simple": "no"
                                    },
                                    "key": {
                                        "complex": {
                                            "accessor": "id",
                                            "filters": [],
                                            "root": "alert",
                                            "transformers": [
                                                {
                                                    "args": {
                                                        "limit": {
                                                            "isContext": false
                                                        },
                                                        "replaceWith": {
                                                            "isContext": false,
                                                            "value": {
                                                                "simple": "Base64,digresults,EntropyResult,ResolveShortenedURL,Endpoint"
                                                            }
                                                        },
                                                        "toReplace": {
                                                            "isContext": true,
                                                            "value": {
                                                                "simple": "alert.id"
                                                            }
                                                        }
                                                    },
                                                    "operator": "replace"
                                                },
                                                {
                                                    "args": {
                                                        "delimiter": {
                                                            "isContext": false,
                                                            "value": {
                                                                "simple": ","
                                                            }
                                                        }
                                                    },
                                                    "operator": "split"
                                                }
                                            ]
                                        }
                                    }
                                },
                                "buttonClass": "CLEAR",
                                "dropEffect": "move",
                                "endCol": 4,
                                "fieldId": "",
                                "height": 44,
                                "hexColor": null,
                                "id": "40ca1f30-b1d2-11ed-9b75-f5e3e7c3244c",
                                "index": 0,
                                "listId": "3podiwrjhh-2fabcc30-b1d2-11ed-9b75-f5e3e7c3244c",
                                "name": "Clear Results",
                                "scriptId": "DeleteContext",
                                "sectionItemType": "button",
                                "startCol": 2
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Clear Results",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 6
                    }
                ],
                "type": "custom"
            },
            {
                "id": "warRoom",
                "name": "War Room",
                "type": "warRoom"
            },
            {
                "id": "workPlan",
                "name": "Work Plan",
                "type": "workPlan"
            },
            {
                "id": "canvas",
                "name": "Canvas",
                "type": "canvas",
                "hidden": false
            }
        ]
    },
    "group": "incident",
    "id": "Identity Analytics Alerts",
    "name": "Identity Analytics Alerts",
    "quickView": {
        "sections": [
            {
                "description": "",
                "fields": [
                    {
                        "fieldId": "incident_type",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_severity",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_owner",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_dbotstatus",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_sourcebrand",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_sourceinstance",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_playbookid",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_phase",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_roles",
                        "isVisible": true
                    }
                ],
                "isVisible": true,
                "name": "Basic Information",
                "query": null,
                "queryType": "",
                "readOnly": false,
                "type": ""
            },
            {
                "description": "",
                "fields": [
                    {
                        "fieldId": "incident_dbotcreated",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_occurred",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_dbotduedate",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_dbotmodified",
                        "isVisible": true
                    },
                    {
                        "fieldId": "incident_dbottotaltime",
                        "isVisible": true
                    }
                ],
                "isVisible": true,
                "name": "Timeline Information",
                "query": null,
                "queryType": "",
                "readOnly": false,
                "type": ""
            },
            {
                "description": "",
                "fields": [
                    {
                        "fieldId": "incident_phonenumber",
                        "isVisible": true
                    }
                ],
                "isVisible": true,
                "name": "Custom Fields",
                "query": null,
                "queryType": "",
                "readOnly": false,
                "type": ""
            },
            {
                "description": "",
                "fields": [
                    {
                        "fieldId": "incident_labels",
                        "isVisible": true
                    }
                ],
                "isVisible": true,
                "name": "Labels",
                "query": null,
                "queryType": "",
                "readOnly": true,
                "type": "labels"
            }
        ]
    },
    "system": false,
    "version": -1,
    "fromVersion": "6.10.0",
    "description": ""
}