Prisma Cloud - Network API and Anomaly Incident Layout
Prisma Cloud by Palo Alto Networks Incident
Details
| ID | Prisma Cloud - Network API and Anomaly Incident Layout |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.10.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Alert Info 6 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 26 |
| severity | Col 0-2, Height: 26 |
| owner | Col 0-2, Height: 26 |
| sourcebrand | Col 0-2, Height: 26 |
| sourceinstance | Col 0-2, Height: 26 |
| playbookid | Col 0-2, Height: 26 |
Notes
Work Plan
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-1, Height: 53 |
| dbotmodified | Col 0-1, Height: 53 |
| dbotduedate | Col 0-2, Height: 53 |
| dbotcreated | Col 1-2, Height: 53 |
| dbotclosed | Col 1-2, Height: 53 |
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 26 |
| closereason | Col 0-2, Height: 26 |
| closenotes | Col 0-2, Height: 26 |
War Room Entries
Alert Data 4 sections
Involved Assets
| Field ID | Position |
|---|---|
| mitreattcktechnique | Col 0-2, Height: 26 |
| username | Col 0-2, Height: 26 |
| userrisklevel | Col 0-2, Height: 26 |
| hostname | Col 0-2, Height: 26 |
| remoteip | Col 0-2, Height: 26 |
Policy Details
| Field ID | Position |
|---|---|
| policyid | Col 0-2, Height: 26 |
| policytype | Col 0-2, Height: 26 |
| lastmodifiedon | Col 0-2, Height: 26 |
| lastseen | Col 0-2, Height: 26 |
| lastmodifiedby | Col 0-2, Height: 26 |
| policyrecommendation | Col 0-2, Height: 52 |
Cloud Resource Details
| Field ID | Position |
|---|---|
| cloudprovider | Col 0-2, Height: 26 |
| resourcename | Col 0-2, Height: 26 |
| accountid | Col 0-2, Height: 26 |
| referencedresourcename | Col 0-2, Height: 26 |
| cloudresourcetype | Col 0-2, Height: 26 |
| region | Col 0-2, Height: 26 |
| regionid | Col 0-2, Height: 26 |
| resourceurl | Col 0-2, Height: 26 |
| resourcetype | Col 0-2, Height: 26 |
Prisma Cloud Related Rules
| Field ID | Position |
|---|---|
| alertrules | Col 0-6, Height: 52 |
Work Plan Summary 4 sections
Investigation Verdict
Investigation Results
| Field ID | Position |
|---|---|
| ipreputation | Col 0-2, Height: 53 |
| sourcegeolocation | Col 0-2, Height: 53 |
| userrisklevel | Col 0-2, Height: 26 |
| cveid | Col 2-4, Height: 53 |
| cvss | Col 2-4, Height: 53 |
| cvedescription | Col 2-4, Height: 53 |
| cvepublished | Col 2-4, Height: 53 |
| vulnerableproduct | Col 2-4, Height: 53 |
IR Actions Status
| Field ID | Position |
|---|---|
| ipblockedstatus | Col 0-2, Height: 26 |
| userblockstatus | Col 0-2, Height: 26 |
Malicious or Suspicious Indicators
Action Center 4 sections
Actions
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
Work Plan
Query Results
| Field ID | Position |
|---|---|
| customqueryresults | Col 0-6, Height: 106 |
Analyst Chat
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Canvas 0 sections
No sections defined.