Malware Investigation and Response
Malware Investigation and Response Incident
Details
| ID | Malware Investigation and Response |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.5.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Incident Info 8 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 22 |
| severity | Col 0-2, Height: 22 |
| owner | Col 0-2, Height: 22 |
| playbookid | Col 0-2, Height: 22 |
| tags | Col 0-2, Height: 22 |
| dbotsource | Col 0-2, Height: 22 |
| closereason | Col 0-2, Height: 22 |
| closenotes | Col 0-2, Height: 44 |
Work Plan
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-1, Height: 53 |
| dbotmodified | Col 0-1, Height: 53 |
| triagesla | Col 0-1, Height: 53 |
| remediationsla | Col 0-1, Height: 53 |
| dbotcreated | Col 1-2, Height: 53 |
| dbotclosed | Col 1-2, Height: 53 |
| containmentsla | Col 1-2, Height: 53 |
Investigation Summary
Response Actions
| Field ID | Position |
|---|---|
| devicename | Col 0-2, Height: 22 |
| processname | Col 0-2, Height: 22 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
Source details
| Field ID | Position |
|---|---|
| processpath | Col 0-2, Height: 22 |
| processname | Col 0-2, Height: 22 |
| md5 | Col 0-2, Height: 22 |
| sha1 | Col 0-2, Height: 22 |
| sha256 | Col 0-2, Height: 22 |
| externallink | Col 0-2, Height: 22 |
| description | Col 0-2, Height: 22 |
Endpoint Details
| Field ID | Position |
|---|---|
| devicename | Col 0-2, Height: 22 |
| deviceid | Col 0-2, Height: 22 |
| devicestatus | Col 0-2, Height: 22 |
| deviceexternalip | Col 0-2, Height: 22 |
| devicelocalip | Col 0-2, Height: 22 |
| deviceusername | Col 0-2, Height: 22 |
| deviceosname | Col 0-2, Height: 22 |
| deviceosversion | Col 0-2, Height: 22 |
| devicemacaddress | Col 0-2, Height: 22 |
| agentversion | Col 0-2, Height: 22 |
| isolated | Col 0-2, Height: 22 |
Account Information
| Field ID | Position |
|---|---|
| accountname | Col 0-2, Height: 22 |
| accountstatus | Col 0-2, Height: 22 |
| samaccountname | Col 0-2, Height: 22 |
| managername | Col 0-2, Height: 22 |
| manageremailaddress | Col 0-2, Height: 22 |
| accountmemberof | Col 0-2, Height: 22 |
Investigation 3 sections
Investigation
Indicators
All associated indicators with the current incident.
Alerts
| Field ID | Position |
|---|---|
| alertsandrelatedinfo | Col 0-4, Height: 106 |
Forensics 2 sections
Process List
Disclaimer: This section is currently supported by Cortex XDR And CrowdStrike Falcon integrations only.
NetStat
Disclaimer: This section is currently supported by CrowdStrike Falcon integration only.
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.