Symantec EDR Incident layout
Layout for Symantec EDR incident
Details
| ID | Symantec EDR Incident layout |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.5.0 |
Layout Structure
Case info 9 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 22 |
| dbotsource | Col 0-2, Height: 22 |
| sourceinstance | Col 0-2, Height: 22 |
| sourcebrand | Col 0-2, Height: 22 |
| severity | Col 0-2, Height: 22 |
| owner | Col 0-2, Height: 22 |
| playbookid | Col 0-2, Height: 22 |
| occurred | Col 0-2, Height: 22 |
Notes
Team Members
Incident Details
| Field ID | Position |
|---|---|
| externalid | Col 0-2, Height: 22 |
| symantecedrdetectiontype | Col 0-2, Height: 22 |
| description | Col 0-2, Height: 22 |
| logsourcename | Col 0-2, Height: 22 |
| uuid | Col 0-2, Height: 22 |
| sourcepriority | Col 0-2, Height: 22 |
| sourcestatus | Col 0-2, Height: 22 |
| symantecedrruleid | Col 2-4, Height: 22 |
| rulename | Col 2-4, Height: 22 |
| firstseen | Col 2-4, Height: 22 |
| lastseen | Col 2-4, Height: 22 |
| sourcecreatetime | Col 2-4, Height: 22 |
| lastupdatetime | Col 2-4, Height: 22 |
Incident Comments
| Field ID | Position |
|---|---|
| symantecedrincidentcomments | Col 0-4, Height: 106 |
Incident Resolution
| Field ID | Position |
|---|---|
| closingreason | Col 0-4, Height: 22 |
| symantecedrrecommendedaction | Col 0-4, Height: 44 |
Work Plan
EDR Events Attacks
| Field ID | Position |
|---|---|
| symantecedrattacks | Col 0-4, Height: 106 |
Malicious or Suspicious Indicators
Investigation 8 sections
EDR Events
| Field ID | Position |
|---|---|
| symantecedrincidentevents | Col 0-6, Height: 106 |
Event Actor
| Field ID | Position |
|---|---|
| symantecedreventactor | Col 0-6, Height: 106 |
EDR Event Enriched Data
| Field ID | Position |
|---|---|
| symantecedrenricheddata | Col 0-6, Height: 106 |
Event Actor File
| Field ID | Position |
|---|---|
| symantecedreventactorfile | Col 0-6, Height: 106 |
Event User
| Field ID | Position |
|---|---|
| symantecedreventactoruser | Col 0-2, Height: 106 |
Event Process
| Field ID | Position |
|---|---|
| symantecedreventprocess | Col 0-4, Height: 106 |
Process User
| Field ID | Position |
|---|---|
| symantecedrprocessuser | Col 0-2, Height: 106 |
Process File
| Field ID | Position |
|---|---|
| symantecedrprocessfile | Col 0-6, Height: 106 |
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Canvas 0 sections
No sections defined.