{
"description": "The default layout for phishing incidents.",
"detailsV2": {
"tabs": [
{
"id": "summary",
"name": "Legacy Summary",
"type": "summary"
},
{
"id": "qoey6clq4l",
"name": "Alert Details",
"sections": [
{
"description": "",
"displayType": "ROW",
"h": 2,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "type",
"height": 26,
"id": "incident-type-field",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "reportedemailorigin",
"height": 26,
"id": "69c68fc0-78ad-11ee-83ba-e99e7220b301",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "severity",
"height": 26,
"id": "incident-severity-field",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourcebrand",
"height": 26,
"id": "incident-sourceBrand-field",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sourceinstance",
"height": 26,
"id": "incident-sourceInstance-field",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "owner",
"height": 26,
"id": "incident-owner-field",
"index": 5,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"moved": false,
"name": "Alert Details",
"static": false,
"w": 1,
"x": 0,
"y": 0
},
{
"h": 2,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
"maxW": 3,
"moved": false,
"name": "Notes",
"static": false,
"type": "notes",
"w": 1,
"x": 2,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8",
"maxW": 3,
"moved": false,
"name": "Work Plan",
"static": false,
"type": "workplan",
"w": 1,
"x": 2,
"y": 0
},
{
"displayType": "ROW",
"h": 6,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-7ce69dd0-a07f-11e9-936c-5395a1acf11e",
"maxW": 3,
"moved": false,
"name": "Indicators",
"query": "",
"queryType": "input",
"static": false,
"type": "indicators",
"w": 2,
"x": 0,
"y": 2
},
{
"displayType": "CARD",
"h": 2,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
"items": [
{
"endCol": 1,
"fieldId": "occurred",
"height": 53,
"id": "0339c950-730a-11ee-a22e-872f04e65504",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 1,
"fieldId": "dbotduedate",
"height": 53,
"id": "incident-dueDate-field",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotmodified",
"height": 53,
"id": "incident-modified-field",
"index": 0,
"listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
"sectionItemType": "field",
"startCol": 1
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "dbotcreated",
"height": 53,
"id": "incident-created-field",
"index": 1,
"listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
"sectionItemType": "field",
"startCol": 1
}
],
"maxW": 3,
"moved": false,
"name": "Timeline Information",
"static": false,
"w": 1,
"x": 1,
"y": 0
},
{
"displayType": "ROW",
"h": 2,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289",
"isVisible": true,
"items": [
{
"endCol": 2,
"fieldId": "dbotclosed",
"height": 26,
"id": "incident-dbotClosed-field",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closereason",
"height": 26,
"id": "incident-closeReason-field",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "closenotes",
"height": 26,
"id": "incident-closeNotes-field",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"moved": false,
"name": "Closing Information",
"static": false,
"w": 1,
"x": 2,
"y": 6
},
{
"description": "Indicators that the user selected to block, when blocking is done in manual (default) mode.",
"h": 2,
"i": "qoey6clq4l-17422030-7668-11ee-953f-9166c9f595d1",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Blocked Indicators",
"query": "tags:\"Blocked Indicator In Systems\"",
"queryType": "input",
"static": false,
"type": "indicators",
"w": 1,
"x": 2,
"y": 2
}
],
"type": "custom"
},
{
"id": "caseinfoid",
"name": "Email Details",
"sections": [
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-f11047e0-7309-11ee-a22e-872f04e65504",
"items": [
{
"endCol": 2,
"fieldId": "reportedemailfrom",
"height": 26,
"id": "5cd84dc0-730e-11ee-a22e-872f04e65504",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "reportedemailto",
"height": 26,
"id": "1b19e690-730f-11ee-a22e-872f04e65504",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "emailsubject",
"height": 26,
"id": "29301bf0-730a-11ee-a22e-872f04e65504",
"index": 2,
"listId": "qoey6clq4l-olzmwfmu0d-caseinfoid-f11047e0-7309-11ee-a22e-872f04e65504",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "reporteremailaddress",
"height": 26,
"id": "384be830-730a-11ee-a22e-872f04e65504",
"index": 3,
"listId": "qoey6clq4l-olzmwfmu0d-caseinfoid-f11047e0-7309-11ee-a22e-872f04e65504",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "emailcc",
"height": 26,
"id": "81c30ba0-7662-11ee-953f-9166c9f595d1",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "emailbcc",
"height": 26,
"id": "801a64b0-7662-11ee-953f-9166c9f595d1",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "emailrecipientscount",
"height": 26,
"id": "ae6b6350-7662-11ee-953f-9166c9f595d1",
"index": 6,
"listId": "qoey6clq4l-olzmwfmu0d-caseinfoid-f11047e0-7309-11ee-a22e-872f04e65504",
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Email Information",
"static": false,
"w": 1,
"wrapLabels": true,
"x": 0,
"y": 0
},
{
"description": "Information about attachments extracted from the reported email.",
"displayType": "ROW",
"h": 3,
"hideName": false,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-ac5bc040-730c-11ee-a22e-872f04e65504",
"items": [
{
"endCol": 2,
"fieldId": "attachmentname",
"height": 26,
"id": "d4dcdc70-730c-11ee-a22e-872f04e65504",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "attachmentextension",
"height": 26,
"id": "d361ae20-730c-11ee-a22e-872f04e65504",
"index": 1,
"listId": "caseinfoid-ac5bc040-730c-11ee-a22e-872f04e65504",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "attachmenttype",
"height": 26,
"id": "449c1150-730a-11ee-a22e-872f04e65504",
"index": 2,
"listId": "caseinfoid-f11047e0-7309-11ee-a22e-872f04e65504",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "attachmentsize",
"height": 26,
"id": "d7901590-730c-11ee-a22e-872f04e65504",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "attachmenthash",
"height": 26,
"id": "dd827420-730c-11ee-a22e-872f04e65504",
"index": 4,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Attachment Information",
"static": false,
"w": 1,
"wrapLabels": false,
"x": 0,
"y": 5
},
{
"description": "All file attachments of the email, and the email file itself if it was attached or retrieved.",
"displayType": "CARD",
"h": 2,
"hideItemTitleOnlyOne": true,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-c8881f70-730c-11ee-a22e-872f04e65504",
"items": [
{
"endCol": 2,
"fieldId": "incident_attachment",
"height": 53,
"id": "c8811a91-730c-11ee-a22e-872f04e65504",
"index": 0,
"isVisible": true,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Attachments",
"static": false,
"type": "",
"w": 1,
"x": 0,
"y": 3
},
{
"description": "",
"h": 1,
"hideName": true,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-7bec8010-730d-11ee-a22e-872f04e65504",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Alert Scope",
"query": "LinkToPhishingCampaign",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 1,
"x": 0,
"y": 2
},
{
"h": 5,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-58e10f00-7326-11ee-ae15-4554156b85ba",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Email & URL Screenshots",
"query": {
"categories": [
"tags"
],
"preDefinedFilters": true,
"tags": [
"url_screenshots",
"email_html_image"
]
},
"queryType": "warRoomFilter",
"static": false,
"type": "invTimeline",
"w": 1,
"x": 1,
"y": 3
},
{
"description": ":warning: This section contains the original HTML of the email. Links may lead to malicious websites!",
"h": 3,
"i": "qoey6clq4l-olzmwfmu0d-caseinfoid-1193c500-7332-11ee-ae15-4554156b85ba",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Email HTML",
"query": "DisplayHTMLWithImages",
"queryType": "script",
"static": false,
"type": "dynamic",
"w": 2,
"x": 1,
"y": 0
},
{
"description": "If executed, the email corresponding to the Message ID below will be deleted from the mailbox of the user specified below.",
"displayType": "ROW",
"h": 3,
"hideItemTitleOnlyOne": false,
"hideName": false,
"i": "qoey6clq4l-10903f00-7664-11ee-953f-9166c9f595d1",
"items": [
{
"endCol": 2,
"fieldId": "reportedemailto",
"height": 26,
"id": "44caa090-77da-11ee-8948-f393fb37ff06",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "emailsubject",
"height": 26,
"id": "21edcd80-77db-11ee-8948-f393fb37ff06",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "reportedemailmessageid",
"height": 26,
"id": "7d926f60-7664-11ee-953f-9166c9f595d1",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "emaildeletetype",
"height": 26,
"id": "868fc400-7664-11ee-953f-9166c9f595d1",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "emaildeletefrombrand",
"height": 26,
"id": "8c010bb0-7664-11ee-953f-9166c9f595d1",
"index": 3,
"sectionItemType": "field",
"startCol": 0
},
{
"args": {
"delete_from_brand": {
"simple": "${alert.sourcebrand}"
},
"delete_type": {
"simple": "${alert.emaildeletetype}"
},
"polling": {
"simple": "true"
},
"search_name": {
"simple": "Search & Delete Executed from XSIAM alert layout."
}
},
"buttonClass": null,
"endCol": 2,
"fieldId": "",
"height": 44,
"hexColor": "#b20000",
"id": "923b96d0-7664-11ee-953f-9166c9f595d1",
"index": 4,
"name": "Delete Email",
"scriptId": "DeleteReportedEmail",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Action Center",
"static": false,
"w": 1,
"wrapLabels": true,
"x": 2,
"y": 3
},
{
"description": "",
"displayType": "CARD",
"h": 2,
"hideName": false,
"i": "qoey6clq4l-4d2c2fe0-7665-11ee-953f-9166c9f595d1",
"items": [
{
"endCol": 2,
"fieldId": "emaildeleteresult",
"height": 26,
"id": "66aafb40-7665-11ee-953f-9166c9f595d1",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "emaildeletereason",
"height": 26,
"id": "67c719a0-7665-11ee-953f-9166c9f595d1",
"index": 1,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Email Delete Result",
"static": false,
"w": 1,
"wrapLabels": true,
"x": 2,
"y": 6
}
],
"type": "custom"
},
{
"hidden": false,
"id": "opvds8dnjq",
"name": "Email Analysis",
"sections": [
{
"displayType": "ROW",
"h": 5,
"hideName": false,
"i": "qoey6clq4l-caseinfoid-20aaaf10-730d-11ee-a22e-872f04e65504",
"items": [
{
"endCol": 4,
"fieldId": "emailhtml",
"height": 52,
"id": "33b36cf0-730d-11ee-a22e-872f04e65504",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Raw Email HTML",
"static": false,
"w": 2,
"x": 0,
"y": 7
},
{
"description": "",
"displayType": "ROW",
"h": 4,
"hideItemTitleOnlyOne": true,
"hideName": false,
"i": "qoey6clq4l-caseinfoid-42d26d80-730d-11ee-a22e-872f04e65504",
"items": [
{
"endCol": 4,
"fieldId": "emailheaders",
"height": 106,
"id": "4c56f380-730d-11ee-a22e-872f04e65504",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Email Headers",
"static": false,
"w": 2,
"x": 0,
"y": 0
},
{
"description": "Analysis of SPF, DKIM, DMARC and Microsoft anti-spam headers.\n\nFor Microsoft anti-spam headers, please click on each item for the relevant documentation:\n\n[PCL](https://docs.microsoft.com/en-us/exchange/antispam-and-antimalware/antispam-protection/antispam-stamps?view=exchserver-2019) - Phishing Confidence Level.\n\n[BCL](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/bulk-complaint-level-values?view=o365-worldwide) - Bulk Complaint Level.\n\n[SCL](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/spam-confidence-levels?view=o365-worldwide) - Spam Confidence Level.\n\n`Note`: The default value is 0, but it can be changed when the \"Process Microsoft's Email Headers\" playbook runs.",
"displayType": "CARD",
"h": 4,
"hideName": false,
"i": "qoey6clq4l-caseinfoid-66229470-730f-11ee-a22e-872f04e65504",
"items": [
{
"endCol": 1,
"fieldId": "emailauthenticitycheck",
"height": 53,
"id": "c8cb62a0-730f-11ee-a22e-872f04e65504",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 1,
"fieldId": "phishingbclscore",
"height": 53,
"id": "d13fff40-730f-11ee-a22e-872f04e65504",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "phishingpclscore",
"height": 53,
"id": "d44fb040-730f-11ee-a22e-872f04e65504",
"index": 0,
"listId": "caseinfoid-66229470-730f-11ee-a22e-872f04e65504",
"sectionItemType": "field",
"startCol": 1
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "phishingsclscore",
"height": 53,
"id": "cd6cfe40-730f-11ee-a22e-872f04e65504",
"index": 1,
"listId": "caseinfoid-66229470-730f-11ee-a22e-872f04e65504",
"sectionItemType": "field",
"startCol": 1
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Header Analysis",
"static": false,
"w": 1,
"wrapLabels": false,
"x": 2,
"y": 0
},
{
"description": "",
"displayType": "ROW",
"h": 1,
"hideName": false,
"i": "qoey6clq4l-fbd09aa0-7669-11ee-953f-9166c9f595d1",
"items": [
{
"endCol": 2,
"fieldId": "relatedcampaign",
"height": 26,
"id": "481184f0-766b-11ee-953f-9166c9f595d1",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "relatedreport",
"height": 26,
"id": "4a5d49b0-766b-11ee-953f-9166c9f595d1",
"index": 1,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Threat Intelligence Analysis",
"static": false,
"w": 1,
"x": 2,
"y": 4
},
{
"description": "",
"displayType": "ROW",
"h": 5,
"hideItemTitleOnlyOne": true,
"hideName": false,
"i": "qoey6clq4l-25c29a00-766c-11ee-953f-9166c9f595d1",
"items": [
{
"endCol": 2,
"fieldId": "macrosourcecode",
"height": 26,
"id": "b5ad6bc0-7704-11ee-8d8f-35fb0a410368",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Macro Source Code",
"static": false,
"w": 1,
"x": 2,
"y": 7
},
{
"description": "Requires the **Microsoft 365 Defender** integration.",
"displayType": "CARD",
"h": 3,
"hideName": false,
"i": "qoey6clq4l-907471c0-766c-11ee-953f-9166c9f595d1",
"items": [
{
"dropEffect": "move",
"endCol": 1,
"fieldId": "maliciousurlviewed",
"height": 53,
"id": "ad987760-766c-11ee-953f-9166c9f595d1",
"index": 0,
"listId": "qoey6clq4l-907471c0-766c-11ee-953f-9166c9f595d1",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 4,
"fieldId": "clickedurls",
"height": 106,
"id": "d3b516b0-766c-11ee-953f-9166c9f595d1",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "maliciousurlclicked",
"height": 53,
"id": "abcedaf0-766c-11ee-953f-9166c9f595d1",
"index": 0,
"listId": "qoey6clq4l-907471c0-766c-11ee-953f-9166c9f595d1",
"sectionItemType": "field",
"startCol": 1
},
{
"dropEffect": "move",
"endCol": 3,
"fieldId": "totalmaliciousurlsclicks",
"height": 53,
"id": "b79f4cc0-766c-11ee-953f-9166c9f595d1",
"index": 0,
"listId": "qoey6clq4l-907471c0-766c-11ee-953f-9166c9f595d1",
"sectionItemType": "field",
"startCol": 2
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Malicious URL Clicks",
"static": false,
"w": 2,
"wrapLabels": false,
"x": 0,
"y": 4
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "qoey6clq4l-3e81de90-766f-11ee-953f-9166c9f595d1",
"items": [
{
"endCol": 2,
"fieldId": "emailkeywords",
"height": 26,
"id": "af4cd6c0-766f-11ee-953f-9166c9f595d1",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "domainsquattingresult",
"height": 26,
"id": "b21ee280-766f-11ee-953f-9166c9f595d1",
"index": 1,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Investigation Insights",
"static": false,
"w": 1,
"x": 2,
"y": 5
}
],
"showEmptyFields": true,
"type": "custom"
},
{
"id": "warRoom",
"name": "War Room",
"type": "warRoom"
},
{
"id": "workPlan",
"name": "Work Plan",
"type": "workPlan"
},
{
"id": "canvas",
"name": "Canvas",
"type": "canvas",
"hidden": false
}
]
},
"group": "incident",
"id": "Phishing Layout",
"name": "Phishing Layout",
"system": false,
"version": -1,
"marketplaces": [
"marketplacev2",
"platform"
],
"fromVersion": "6.10.0"
}