{
"id": "PANW Endpoint Malware",
"group": "incident",
"name": "PANW Endpoint Malware Incident",
"description": "",
"version": -1,
"fromVersion": "6.0.0",
"detailsV2": {
"tabs": [
{
"hidden": false,
"id": "1vduzkpmlh",
"name": "Case info",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "type",
"height": 24,
"id": "1cc0c4a0-9bd7-11e9-ba23-8723b1f1df6b",
"index": 0,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "details",
"height": 48,
"id": "d8968bd0-aed6-11e9-b2ef-e7ba47745af6",
"index": 1,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "subtype",
"height": 24,
"id": "c9062bd0-aed6-11e9-b2ef-e7ba47745af6",
"index": 2,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "dbotsource",
"height": 24,
"id": "87e18ad0-9bd7-11e9-ba23-8723b1f1df6b",
"index": 3,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sourcebrand",
"height": 24,
"id": "42f03130-9bee-11e9-9a3f-8b4b2158e260",
"index": 4,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "severity",
"height": 24,
"id": "20430d90-9bd7-11e9-ba23-8723b1f1df6b",
"index": 5,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "playbookid",
"height": 24,
"id": "930bb7a0-a866-11e9-aeb8-c3448b5d692d",
"index": 6,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "owner",
"height": 24,
"id": "4fd2b640-a7d6-11e9-8433-9f52f2917950",
"index": 7,
"listId": "fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceinstance",
"height": 24,
"id": "43cfe2d0-9bee-11e9-9a3f-8b4b2158e260",
"index": 8,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "trapsid",
"height": 24,
"id": "dfc0c680-e52e-11e9-9119-dd13c8e6c89c",
"index": 9,
"listId": "1vduzkpmlh-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Case Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Notes",
"readOnly": true,
"static": false,
"type": "notes",
"w": 1,
"x": 2,
"y": 2
},
{
"columns": [
{
"displayed": true,
"isDefault": false,
"key": "id",
"width": 110
},
{
"displayed": true,
"isDefault": true,
"key": "name",
"width": 300
},
{
"displayed": true,
"isDefault": false,
"key": "owner",
"width": 160
},
{
"displayed": true,
"isDefault": true,
"key": "type",
"width": 200
},
{
"displayed": true,
"isDefault": true,
"key": "status",
"width": 80
},
{
"displayed": true,
"isDefault": true,
"key": "closeNotes",
"width": 300
}
],
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "1vduzkpmlh-770ec200-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Linked Incidents",
"readOnly": true,
"static": false,
"type": "linkedIncidents",
"w": 1,
"x": 1,
"y": 4
},
{
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "1vduzkpmlh-842632c0-98b1-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Child Incidents",
"readOnly": true,
"static": false,
"type": "childInv",
"w": 1,
"x": 1,
"y": 5
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-4a31afa0-98ba-11e9-a519-93a53c759fe0",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Evidence",
"readOnly": true,
"static": false,
"type": "evidence",
"w": 1,
"x": 0,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-7717e580-9bed-11e9-9a3f-8b4b2158e260",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Team Members",
"readOnly": true,
"static": false,
"type": "team",
"w": 1,
"x": 1,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"isVisible": true,
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotcreated",
"height": 24,
"id": "930bf0a0-a864-11e9-aeb8-c3448b5d692d",
"index": 0,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "occurred",
"height": 24,
"id": "e92b52b0-a863-11e9-aeb8-c3448b5d692d",
"index": 1,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "dbotmodified",
"height": 24,
"id": "99cbd860-a864-11e9-aeb8-c3448b5d692d",
"index": 2,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotclosed",
"height": 24,
"id": "a1a67ef0-a864-11e9-aeb8-c3448b5d692d",
"index": 3,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "remediationsla",
"height": 24,
"id": "6cd9de10-9bee-11e9-9a3f-8b4b2158e260",
"index": 4,
"listId": "24257a20-98b1-11e9-97d7-ed26ef9e46c8",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "detectionsla",
"height": 24,
"id": "6b72acf0-9bee-11e9-9a3f-8b4b2158e260",
"index": 5,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotduedate",
"height": 24,
"id": "551d6320-a7d6-11e9-8433-9f52f2917950",
"index": 6,
"listId": "c9b7ded0-a863-11e9-aeb8-c3448b5d692d",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Timeline Information",
"static": false,
"w": 1,
"x": 0,
"y": 2
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-e462ffc0-a864-11e9-aeb8-c3448b5d692d",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "xdrresolvecomment",
"height": 24,
"id": "5a450d90-ac8a-11e9-a30b-53d47e1ea7d7",
"index": 0,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotclosed",
"height": 24,
"id": "427bf020-a866-11e9-aeb8-c3448b5d692d",
"index": 1,
"listId": "e462ffc0-a864-11e9-aeb8-c3448b5d692d",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closereason",
"height": 24,
"id": "f23f6e30-a864-11e9-aeb8-c3448b5d692d",
"index": 2,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closinguserid",
"height": 24,
"id": "f387a5a0-a864-11e9-aeb8-c3448b5d692d",
"index": 3,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closenotes",
"height": 48,
"id": "f579ffc0-a864-11e9-aeb8-c3448b5d692d",
"index": 4,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Closing Information",
"static": false,
"w": 1,
"x": 2,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-2c705cf0-aed1-11e9-b2ef-e7ba47745af6",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "agentid",
"height": 24,
"id": "023fdea0-e52d-11e9-9119-dd13c8e6c89c",
"index": 0,
"listId": "1vduzkpmlh-2c705cf0-aed1-11e9-b2ef-e7ba47745af6",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "src",
"height": 24,
"id": "5eb7c310-aed1-11e9-b2ef-e7ba47745af6",
"index": 1,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "devicename",
"height": 24,
"id": "e3456100-aed6-11e9-b2ef-e7ba47745af6",
"index": 2,
"listId": "2c705cf0-aed1-11e9-b2ef-e7ba47745af6",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "srcntdomain",
"height": 24,
"id": "6a8108f0-aed1-11e9-b2ef-e7ba47745af6",
"index": 3,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "srcuser",
"height": 24,
"id": "61db9850-aed1-11e9-b2ef-e7ba47745af6",
"index": 4,
"listId": "2c705cf0-aed1-11e9-b2ef-e7ba47745af6",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "srcos",
"height": 24,
"id": "6c842bf0-aed1-11e9-b2ef-e7ba47745af6",
"index": 5,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "isolated",
"height": 24,
"id": "ab65f010-b1f1-11e9-abe0-ffea6822b899",
"index": 6,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Source Details",
"static": false,
"w": 1,
"x": 1,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "1vduzkpmlh-3c50ffd0-aed1-11e9-b2ef-e7ba47745af6",
"items": [
{
"endCol": 2,
"fieldId": "filename",
"height": 24,
"id": "818bee20-aed1-11e9-b2ef-e7ba47745af6",
"index": 0,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filepath",
"height": 24,
"id": "83760ae0-aed1-11e9-b2ef-e7ba47745af6",
"index": 1,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "filehash",
"height": 24,
"id": "84e4dd20-aed1-11e9-b2ef-e7ba47745af6",
"index": 2,
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "filesize",
"height": 24,
"id": "30ab86e0-aed7-11e9-b2ef-e7ba47745af6",
"index": 3,
"listId": "3c50ffd0-aed1-11e9-b2ef-e7ba47745af6",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "quarantined",
"height": 24,
"id": "ae568050-b1f1-11e9-abe0-ffea6822b899",
"index": 4,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "blockedaction",
"height": 24,
"id": "6cffb2a0-aed3-11e9-b2ef-e7ba47745af6",
"index": 5,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "signature",
"height": 24,
"id": "68e5e7d0-aed7-11e9-b2ef-e7ba47745af6",
"index": 6,
"startCol": 0
},
{
"endCol": 2,
"fieldId": "terminatedaction",
"height": 24,
"id": "7b526280-aed3-11e9-b2ef-e7ba47745af6",
"index": 7,
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "File Attributes",
"static": false,
"w": 1,
"x": 2,
"y": 0
}
],
"type": "custom"
},
{
"hidden": false,
"id": "swtuqptgvs",
"name": "Investigation",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "swtuqptgvs-067d4900-98b4-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Incident Files",
"query": {
"categories": [
"attachments"
],
"lastId": "",
"pageSize": 100,
"tags": [],
"users": []
},
"queryType": "warRoomFilter",
"readOnly": true,
"static": false,
"type": "invTimeline",
"w": 3,
"x": 0,
"y": 2
},
{
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "swtuqptgvs-cc557320-98b7-11e9-b34a-852d068f44fe",
"isVisible": true,
"items": [],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Indicators",
"query": "",
"queryType": "input",
"readOnly": true,
"static": false,
"type": "indicators",
"w": 3,
"x": 0,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "swtuqptgvs-aff476f0-aed2-11e9-b2ef-e7ba47745af6",
"items": [
{
"endCol": 2,
"fieldId": "malwarefamily",
"height": 22,
"id": "7d1153c0-aed7-11e9-b2ef-e7ba47745af6",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "maliciousbehavior",
"height": 22,
"id": "e3c32710-aed7-11e9-b2ef-e7ba47745af6",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "pid",
"height": 22,
"id": "33ff2940-aed8-11e9-b2ef-e7ba47745af6",
"index": 2,
"listId": "aff476f0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "parentprocessid",
"height": 22,
"id": "36fc3ca0-aed8-11e9-b2ef-e7ba47745af6",
"index": 4,
"listId": "aff476f0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "commandline",
"height": 22,
"id": "5f4cfa00-aed8-11e9-b2ef-e7ba47745af6",
"index": 5,
"listId": "aff476f0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Malware Investigation Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"description": "This section contains indicators found by the 'PANW - Hunting and threat detection by indicator type V2' playbook.",
"displayType": "CARD",
"h": 2,
"hideName": false,
"i": "swtuqptgvs-f5c05aa0-aed2-11e9-b2ef-e7ba47745af6",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "detectedinternalips",
"height": 53,
"id": "340ad2d0-ae51-11ea-bb15-0f2dc915a954",
"index": 0,
"listId": "swtuqptgvs-f5c05aa0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "detectedinternalhosts",
"height": 53,
"id": "271e42a0-ae51-11ea-bb15-0f2dc915a954",
"index": 1,
"listId": "swtuqptgvs-f5c05aa0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "detectedusers",
"height": 53,
"id": "22617de0-ae51-11ea-bb15-0f2dc915a954",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "detectedips",
"height": 53,
"id": "af2b6830-b2d0-11e9-b76c-a5b0af346e12",
"index": 3,
"listId": "swtuqptgvs-f5c05aa0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "detectedhosts",
"height": 53,
"id": "adba9a20-b2d0-11e9-b76c-a5b0af346e12",
"index": 0,
"listId": "swtuqptgvs-f5c05aa0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 2
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "detectedexternalips",
"height": 53,
"id": "250e7570-ae51-11ea-bb15-0f2dc915a954",
"index": 0,
"listId": "swtuqptgvs-f5c05aa0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 2
},
{
"dropEffect": "move",
"endCol": 4,
"fieldId": "detectedexternalhosts",
"height": 53,
"id": "3774ffe0-ae51-11ea-bb15-0f2dc915a954",
"index": 1,
"listId": "swtuqptgvs-f5c05aa0-aed2-11e9-b2ef-e7ba47745af6",
"sectionItemType": "field",
"startCol": 2
}
],
"maxW": 3,
"minH": 1,
"minW": 1,
"moved": false,
"name": "Detected IOCs",
"static": false,
"w": 2,
"x": 1,
"y": 0
}
],
"type": "custom"
},
{
"id": "warRoom",
"name": "War Room",
"type": "warRoom"
},
{
"id": "workPlan",
"name": "Work Plan",
"type": "workPlan"
},
{
"id": "evidenceBoard",
"name": "Evidence Board",
"type": "evidenceBoard"
},
{
"id": "relatedIncidents",
"name": "Related Incidents",
"type": "relatedIncidents"
},
{
"id": "canvas",
"name": "Canvas",
"type": "canvas"
}
]
},
"marketplaces": ["xsoar"]
}