SentinelOne Incident Layout
SentinelOne Incident
Details
| ID | SentinelOne Incident Layout |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.0.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Incident Info 12 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 22 |
| severity | Col 0-2, Height: 22 |
| owner | Col 0-2, Height: 22 |
| sourcebrand | Col 0-2, Height: 22 |
| sourceinstance | Col 0-2, Height: 22 |
| playbookid | Col 0-2, Height: 22 |
Notes
Work Plan
Indicators
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-1, Height: 53 |
| dbotmodified | Col 0-1, Height: 53 |
| dbotduedate | Col 0-2, Height: 53 |
| dbotcreated | Col 1-2, Height: 53 |
| dbotclosed | Col 1-2, Height: 53 |
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 22 |
| closereason | Col 0-2, Height: 22 |
| closenotes | Col 0-2, Height: 44 |
Investigation Data
| Field ID | Position |
|---|---|
| sentineloneaccountid | Col 0-2, Height: 53 |
| sentineloneaccountname | Col 0-2, Height: 53 |
| sentinelonesiteid | Col 0-2, Height: 53 |
| sentinelonesitename | Col 0-2, Height: 53 |
| sentineloneclassificationsource | Col 0-2, Height: 53 |
| sentinelonegroupid | Col 0-2, Height: 53 |
| sentinelonegroupname | Col 0-2, Height: 53 |
SentinelOne Mirrored Fields
| Field ID | Position |
|---|---|
| sentinelonethreatid | Col 0-2, Height: 22 |
| sentinelonethreatanalystverdict | Col 0-2, Height: 22 |
| sentinelonethreatstatus | Col 0-2, Height: 22 |
| sentineloneuamalertstatus | Col 0-2, Height: 22 |
| sentineloneuamalertanalystverdictmapped | Col 0-2, Height: 22 |
SentinelOne Agent Details
| Field ID | Position |
|---|---|
| agentid | Col 0-2, Height: 22 |
| agentversion | Col 0-2, Height: 22 |
| accountmemberof | Col 0-2, Height: 22 |
| deviceid | Col 0-2, Height: 22 |
| deviceosname | Col 0-2, Height: 22 |
| deviceosversion | Col 0-2, Height: 22 |
| sentineloneagentnetworkstatus | Col 0-2, Height: 22 |
SentinelOne Threat Details
| Field ID | Position |
|---|---|
| threatname | Col 0-2, Height: 22 |
| filename | Col 0-2, Height: 22 |
| sentinelonethreatstoryline | Col 0-2, Height: 22 |
| filepath | Col 0-2, Height: 22 |
| filesize | Col 0-2, Height: 22 |
| filemd5 | Col 0-2, Height: 22 |
| filesha1 | Col 0-2, Height: 22 |
| filesha256 | Col 0-2, Height: 22 |
SentinelOne Threat Quick Actions
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
| — | Col 0-2, Height: 44 |
SentinelOne Threat Network Interface Details
| Field ID | Position |
|---|---|
| sentinelonenetworkinterfacedetails | Col 0-4, Height: 106 |
Incident Cloud Provider Details 1 section
SentinelOne Incident Cloud Provider Details
| Field ID | Position |
|---|---|
| sentinelonecloudprovider | Col 0-2, Height: 22 |
| sentinelonecloudprovideraccount | Col 0-2, Height: 22 |
| sentinelonecloudproviderimage | Col 0-2, Height: 22 |
| sentinelonecloudproviderinstanceid | Col 0-2, Height: 22 |
| sentinelonecloudproviderinstancesize | Col 0-2, Height: 22 |
| sentinelonecloudproviderlocation | Col 0-2, Height: 22 |
| sentinelonecloudprovidertags | Col 0-2, Height: 22 |
| sentinelonecloudprovidernetwork | Col 0-2, Height: 22 |
| sentinelonecloudproviderresourcegroup | Col 0-2, Height: 22 |
| sentinelonecloudprovidersecuritygroup | Col 0-2, Height: 22 |
| sentinelonecloudproviderserviceaccount | Col 0-2, Height: 22 |
| sentinelonecloudproviderrole | Col 0-2, Height: 22 |
| sentinelonecloudprovidersubnetid | Col 0-2, Height: 22 |
Incident Kubernetes Details 3 sections
SentinelOne Incident Kubernetes Cluster Details
| Field ID | Position |
|---|---|
| sentinelonekubernetescluster | Col 0-2, Height: 22 |
| sentinelonekubernetescontrollername | Col 0-2, Height: 22 |
| sentinelonekubernetescontrollerkind | Col 0-2, Height: 22 |
| sentinelonekubernetescontrollerlabels | Col 0-2, Height: 22 |
| sentinelonekubernetesnamespace | Col 0-2, Height: 22 |
| sentinelonekubernetesnamespacelabels | Col 0-2, Height: 22 |
| sentinelonekubernetesiscontainerquarantine | Col 0-2, Height: 22 |
SentinelOne Incident Kubernetes Node details
| Field ID | Position |
|---|---|
| sentinelonekubernetesnode | Col 0-2, Height: 22 |
| sentinelonekubernetesnodelabels | Col 0-2, Height: 22 |
SentinelOne Incident Kubernetes Pod Details
| Field ID | Position |
|---|---|
| sentinelonekubernetespod | Col 0-2, Height: 22 |
| sentinelonekubernetespodlabels | Col 0-2, Height: 22 |
Incident UAM Alert Details 1 section
SentinelOne UAM Alert Details
| Field ID | Position |
|---|---|
| sentineloneuamalertid | Col 0-2, Height: 22 |
| sentineloneuamalertname | Col 0-2, Height: 22 |
| sentineloneuamalertdetectionproduct | Col 0-2, Height: 22 |
| sentineloneuamalertattacksurfaces | Col 0-2, Height: 22 |
| sentineloneuamalertanalystverdictmapped | Col 0-2, Height: 22 |
| sentineloneuamalertstatus | Col 0-2, Height: 22 |
| sentineloneuamalertexternalid | Col 0-2, Height: 22 |
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.