{
"edit": {
"sections": [
{
"description": "",
"fields": [
{
"fieldId": "indicator_value",
"isVisible": true
},
{
"fieldId": "indicator_indicatortype",
"isVisible": true
},
{
"fieldId": "indicator_score",
"isVisible": true
},
{
"fieldId": "indicator_expiration",
"isVisible": true
},
{
"fieldId": "indicator_comment",
"isVisible": true
},
{
"fieldId": "indicator_investigationids",
"isVisible": true
}
],
"isVisible": true,
"name": "Basic Information",
"query": null,
"queryType": "",
"readOnly": false,
"type": "basicInformationSection"
},
{
"description": "",
"fields": [
{
"fieldId": "indicator_description",
"isVisible": true
}
],
"isVisible": true,
"name": "Description",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "indicator_sigmaruleid",
"isVisible": true
},
{
"fieldId": "indicator_author",
"isVisible": true
},
{
"fieldId": "indicator_sigmarulelevel",
"isVisible": true
},
{
"fieldId": "indicator_sigmarulestatus",
"isVisible": true
},
{
"fieldId": "indicator_tags",
"isVisible": true
}
],
"isVisible": true,
"name": "Metadata",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "indicator_sigmadetection",
"isVisible": true
},
{
"fieldId": "indicator_sigmacondition",
"isVisible": true
},
{
"fieldId": "indicator_sigmafalsepositives",
"isVisible": true
}
],
"isVisible": true,
"name": "Detections",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
},
{
"description": "",
"fields": [
{
"fieldId": "indicator_product",
"isVisible": true
},
{
"fieldId": "indicator_category",
"isVisible": true
},
{
"fieldId": "indicator_service",
"isVisible": true
},
{
"fieldId": "indicator_definition",
"isVisible": true
}
],
"isVisible": true,
"name": "Log Sources",
"query": null,
"queryType": "",
"readOnly": false,
"type": ""
}
]
},
"group": "indicator",
"id": "Sigma Rule Layout",
"indicatorsDetails": {
"tabs": [
{
"id": "default-main",
"name": "Info",
"sections": [
{
"h": 3,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-relationshipsTable",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Relationships",
"static": false,
"type": "relationshipsTable",
"w": 2,
"x": 0,
"y": 6,
"maxH": null
},
{
"h": 2,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-relatedIncidents",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Related Incidents",
"static": false,
"type": "relatedIncidents",
"w": 2,
"x": 0,
"y": 9,
"maxH": null
},
{
"displayType": "ROW",
"h": 3,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-e2c8c970-a09d-11e9-8956-390f602b039a",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "timestamp",
"height": 26,
"id": "indicator-timestamp",
"index": 1,
"listId": "default-main-e2c8c970-a09d-11e9-8956-390f602b039a",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "modified",
"height": 26,
"id": "indicator-modified",
"index": 2,
"listId": "default-main-e2c8c970-a09d-11e9-8956-390f602b039a",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "expiration",
"height": 26,
"id": "indicator-expiration",
"index": 3,
"listId": "default-main-e2c8c970-a09d-11e9-8956-390f602b039a",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmaruleid",
"height": 26,
"id": "e8734970-4293-11ef-8f1a-b9be5629a211",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "author",
"height": 26,
"id": "04020910-4294-11ef-8f1a-b9be5629a211",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmarulelevel",
"height": 26,
"id": "f7a11710-4293-11ef-8f1a-b9be5629a211",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmarulestatus",
"height": 26,
"id": "f1d50530-4293-11ef-8f1a-b9be5629a211",
"index": 7,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "trafficlightprotocol",
"height": 26,
"id": "8b79dd61-4293-11ef-8f1a-b9be5629a211",
"index": 8,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sigmarulelicense",
"height": 26,
"id": "f5fa44e0-4293-11ef-8f1a-b9be5629a211",
"index": 9,
"listId": "default-main-e2c8c970-a09d-11e9-8956-390f602b039a",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "tags",
"height": 26,
"id": "7f92af40-4293-11ef-8f1a-b9be5629a211",
"index": 10,
"sectionItemType": "field",
"startCol": 0
},
{
"args": {
"field": {
"simple": "tags"
}
},
"dropEffect": "move",
"endCol": 1,
"height": 44,
"id": "8913b2d1-4293-11ef-8f1a-b9be5629a211",
"index": 11,
"name": "Add tags",
"scriptId": "Builtin|||appendIndicatorField",
"sectionItemType": "button",
"startCol": 0
},
{
"args": {
"field": {
"simple": "tags"
}
},
"endCol": 2,
"filters": [
[
{
"id": 0,
"ignoreCase": false,
"left": {
"isContext": true,
"value": {
"simple": "tags"
}
},
"operator": "isNotEmpty",
"right": null,
"type": "tagsSelect"
}
]
],
"height": 44,
"id": "8b79dd62-4293-11ef-8f1a-b9be5629a211",
"index": 11,
"name": "Remove tags",
"scriptId": "Builtin|||removeIndicatorField",
"sectionItemType": "button",
"startCol": 1
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Basic Information",
"static": false,
"w": 1,
"x": 0,
"y": 3,
"maxH": null
},
{
"displayType": "ROW",
"h": 3,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-indicatorTimeline",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Timeline",
"static": false,
"type": "indicatorTimeline",
"w": 1,
"x": 2,
"y": 6,
"maxH": null
},
{
"h": 2,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-comments",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Comments",
"static": false,
"type": "comments",
"w": 1,
"x": 2,
"y": 9,
"maxH": null
},
{
"h": 1,
"hideName": true,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-expirationStatus",
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Expiration Status",
"static": false,
"type": "expirationStatus",
"w": 1,
"x": 0,
"y": 0,
"maxH": null
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-93c3e790-4293-11ef-8f1a-b9be5629a211",
"items": [
{
"endCol": 2,
"fieldId": "product",
"height": 26,
"id": "ab62f670-4293-11ef-8f1a-b9be5629a211",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "service",
"height": 26,
"id": "ae5beb20-4293-11ef-8f1a-b9be5629a211",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "category",
"height": 26,
"id": "b1310420-4293-11ef-8f1a-b9be5629a211",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "definition",
"height": 26,
"id": "b76e4e60-4293-11ef-8f1a-b9be5629a211",
"index": 3,
"listId": "default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-93c3e790-4293-11ef-8f1a-b9be5629a211",
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Log Sources",
"static": false,
"w": 1,
"x": 2,
"y": 4,
"maxH": null
},
{
"displayType": "CARD",
"h": 6,
"hideItemTitleOnlyOne": false,
"hideName": false,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-Sigma Rule Layout-default-main-1654e470-4294-11ef-8f1a-b9be5629a211",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sigmadetection",
"height": 106,
"id": "1b696620-4294-11ef-8f1a-b9be5629a211",
"index": 1,
"listId": "default-main-1654e470-4294-11ef-8f1a-b9be5629a211",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmacondition",
"height": 106,
"id": "4fb7e6e0-4294-11ef-8f1a-b9be5629a211",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmafalsepositives",
"height": 106,
"id": "769fc4a0-58bd-11ef-985f-5f0ea1744742",
"index": 2,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Detections",
"static": false,
"w": 1,
"x": 1,
"y": 0,
"maxH": null
},
{
"displayType": "CARD",
"h": 1,
"hideItemTitleOnlyOne": false,
"hideName": false,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-88188820-53e5-11ef-8590-adf00dd49707",
"items": [
{
"args": {},
"buttonClass": "primary",
"dropEffect": "move",
"endCol": 2,
"fieldId": "",
"height": 53,
"id": "5511b580-53d8-11ef-8590-adf00dd49707",
"index": 0,
"listId": "default-main-88188820-53e5-11ef-8590-adf00dd49707",
"name": "Convert to query",
"scriptId": "sigma-button-convert",
"sectionItemType": "button",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Actions",
"static": false,
"w": 1,
"x": 2,
"y": 0,
"maxH": null
},
{
"displayType": "CARD",
"h": 3,
"hideItemTitleOnlyOne": true,
"hideName": false,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-7dca5540-5400-11ef-8590-adf00dd49707",
"items": [
{
"endCol": 2,
"fieldId": "querylanguage",
"height": 53,
"id": "eb967731-949a-4a8d-bbae-56588ddbe723",
"index": 0,
"sectionItemType": "field",
"startCol": 0,
"dropEffect": "move",
"listId": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-Sigma Rule Layout-default-main-7dca5540-5400-11ef-8590-adf00dd49707"
},
{
"endCol": 2,
"fieldId": "sigmaconvertedquery",
"height": 53,
"id": "71497f30-5400-11ef-8590-adf00dd49707",
"index": 1,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Query",
"static": false,
"w": 1,
"x": 2,
"y": 1,
"maxH": null
},
{
"displayType": "CARD",
"h": 2,
"hideItemTitleOnlyOne": true,
"hideName": false,
"i": "default-main-948860cb-b00d-463c-84a0-543e7a78107e-default-main-6e931d10-5977-11ef-a4cc-a3aa67c8aac6",
"items": [
{
"endCol": 2,
"fieldId": "description",
"height": 52,
"id": "47075d60-5977-11ef-a4cc-a3aa67c8aac6",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Description",
"scrollableDescription": false,
"static": false,
"w": 1,
"wrapLabels": true,
"x": 0,
"y": 1,
"maxH": null
}
],
"type": "custom"
},
{
"hidden": false,
"id": "dqt4oikq8d",
"name": "References",
"sections": [
{
"displayType": "ROW",
"h": 7,
"hideItemTitleOnlyOne": true,
"hideName": false,
"i": "dqt4oikq8d-gyphi1jkwg-b1654590-fa3c-11ee-8a37-5b8ad357ade4",
"items": [
{
"endCol": 6,
"fieldId": "publications",
"height": 106,
"id": "b7b30a90-fa3c-11ee-8a37-5b8ad357ade4",
"index": 0,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "References",
"static": false,
"w": 3,
"x": 0,
"y": 0
}
],
"type": "custom"
}
]
},
"indicatorsQuickView": {
"tabs": [
{
"id": "indicator-quick-view-info",
"name": "Info",
"sections": [
{
"h": 1,
"hideName": true,
"i": "indicator-quick-view-info-expirationStatus",
"maxW": 3,
"moved": false,
"name": "Expiration Status",
"static": false,
"type": "expirationStatus",
"w": 1,
"x": 0,
"y": 0
},
{
"displayType": "ROW",
"h": 4,
"hideItemTitleOnlyOne": false,
"i": "indicator-quick-view-info-tags-section",
"items": [
{
"endCol": 2,
"fieldId": "description",
"height": 52,
"id": "eaed5f60-5977-11ef-a4cc-a3aa67c8aac6",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmaruleid",
"height": 26,
"id": "df77ad30-5976-11ef-a4cc-a3aa67c8aac6",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "author",
"height": 26,
"id": "e74904f0-5976-11ef-a4cc-a3aa67c8aac6",
"index": 2,
"listId": "indicator-quick-view-info-tags-section",
"sectionItemType": "field",
"startCol": 0
},
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sigmarulelevel",
"height": 26,
"id": "ede4e9f0-5976-11ef-a4cc-a3aa67c8aac6",
"index": 3,
"listId": "indicator-quick-view-info-tags-section",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmarulestatus",
"height": 26,
"id": "f217be30-5976-11ef-a4cc-a3aa67c8aac6",
"index": 4,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "trafficlightprotocol",
"height": 26,
"id": "f71c3a50-5976-11ef-a4cc-a3aa67c8aac6",
"index": 5,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmarulelicense",
"height": 26,
"id": "0456c370-5977-11ef-a4cc-a3aa67c8aac6",
"index": 6,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "tags",
"height": 26,
"id": "indicator-quick-view-info-tags-field",
"index": 7,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmafalsepositives",
"height": 106,
"id": "4ea97250-5978-11ef-a4cc-a3aa67c8aac6",
"index": 8,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Basic Information",
"static": false,
"w": 1,
"x": 0,
"y": 1
},
{
"h": 2,
"i": "indicator-quick-view-info-relatedIncidents",
"maxW": 3,
"moved": false,
"name": "Related Incidents",
"static": false,
"type": "relatedIncidents",
"w": 1,
"x": 0,
"y": 7
},
{
"displayType": "ROW",
"h": 2,
"hideName": false,
"i": "indicator-quick-view-info-10a42d70-5977-11ef-a4cc-a3aa67c8aac6",
"items": [
{
"endCol": 2,
"fieldId": "product",
"height": 26,
"id": "1bb742b0-5977-11ef-a4cc-a3aa67c8aac6",
"index": 0,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "service",
"height": 26,
"id": "201e6d60-5977-11ef-a4cc-a3aa67c8aac6",
"index": 1,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "category",
"height": 26,
"id": "22b4a8a0-5977-11ef-a4cc-a3aa67c8aac6",
"index": 2,
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "definition",
"height": 26,
"id": "24f570e0-5977-11ef-a4cc-a3aa67c8aac6",
"index": 3,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Log Sources",
"static": false,
"w": 1,
"x": 0,
"y": 5
}
],
"type": "custom"
},
{
"hidden": false,
"id": "p56vjtxkfu",
"name": "Detections",
"sections": [
{
"displayType": "ROW",
"h": 6,
"hideName": false,
"i": "p56vjtxkfu-39befc20-5978-11ef-a4cc-a3aa67c8aac6",
"items": [
{
"dropEffect": "move",
"endCol": 2,
"fieldId": "sigmadetection",
"height": 106,
"id": "4132ca90-5978-11ef-a4cc-a3aa67c8aac6",
"index": 0,
"listId": "p56vjtxkfu-39befc20-5978-11ef-a4cc-a3aa67c8aac6",
"sectionItemType": "field",
"startCol": 0
},
{
"endCol": 2,
"fieldId": "sigmacondition",
"height": 106,
"id": "40828d60-5978-11ef-a4cc-a3aa67c8aac6",
"index": 1,
"sectionItemType": "field",
"startCol": 0
}
],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Detections",
"static": false,
"w": 1,
"x": 0,
"y": 0
}
],
"type": "custom"
},
{
"hidden": false,
"id": "kipugrvnuq",
"name": "Relationships",
"sections": [
{
"h": 6,
"i": "kipugrvnuq-65070080-5978-11ef-a4cc-a3aa67c8aac6",
"items": [],
"maxW": 3,
"minH": 1,
"moved": false,
"name": "Relationships",
"static": false,
"type": "relationshipsTable",
"w": 1,
"x": 0,
"y": 0
}
],
"type": "custom"
}
]
},
"name": "Sigma Rule Layout",
"system": false,
"version": -1,
"fromVersion": "6.10.0",
"description": "Out of the box layout for the Sigma Rule indicator."
}