Sysdig Incident

Details

ID	`Sysdig Incident`
Group	incident
Version	-1
From Version	6.0.0
Layout Structure

Legacy Summary 0 sections
No sections defined.
Incident Info 12 sections
Case Details

Field ID	Position
type	Col 0-2, Height: 26
severity	Col 0-2, Height: 26
owner	Col 0-2, Height: 26
sourcebrand	Col 0-2, Height: 26
sourceinstance	Col 0-2, Height: 26
playbookid	Col 0-2, Height: 26
Timeline Information

Field ID	Position
occurred	Col 0-1, Height: 26
dbotmodified	Col 0-1, Height: 26
dbotduedate	Col 0-2, Height: 26
dbotcreated	Col 1-2, Height: 26
dbotclosed	Col 1-2, Height: 26
Notes

Sysdig Event Info

Sysdig event identification and rule details
Field ID	Position
sysdigeventid	Col 0-2, Height: 26
sysdigrulename	Col 0-2, Height: 26
sysdigruletype	Col 0-2, Height: 26
sysdigpolicyname	Col 0-2, Height: 26
sysdigpolicyid	Col 0-2, Height: 26
sysdigsource	Col 0-2, Height: 26
sysdigorigin	Col 0-2, Height: 26
sysdigeventurl	Col 0-2, Height: 26
Container & Host

Container and host identification
Field ID	Position
sysdigcontainerid	Col 0-2, Height: 26
sysdigcontainername	Col 0-2, Height: 26
sysdigcontainerimage	Col 0-2, Height: 26
sysdigcontainerimagetag	Col 0-2, Height: 26
sysdigcontainerimageid	Col 0-2, Height: 26
sysdighostid	Col 0-2, Height: 26
sourcehostname	Col 0-2, Height: 26
macaddress	Col 0-2, Height: 26
sysdigagentversion	Col 0-2, Height: 26
sysdigagentvariant	Col 0-2, Height: 26
Kubernetes Context

Kubernetes context
Field ID	Position
sysdigk8sclustername	Col 0-2, Height: 26
sysdigk8snamespace	Col 0-2, Height: 26
sysdigk8spodname	Col 0-2, Height: 26
sysdigk8snodename	Col 0-2, Height: 26
sysdigk8sworkloadname	Col 0-2, Height: 26
sysdigk8sworkloadtype	Col 0-2, Height: 26
Cloud Context

Cloud provider context
Field ID	Position
sysdigawsaccountid	Col 0-2, Height: 26
sysdigawsregion	Col 0-2, Height: 26
sysdigawsinstanceid	Col 0-2, Height: 26
Process Details

Process details from Falco event
Field ID	Position
sysdigprocessname	Col 0-2, Height: 26
sysdigprocesscmdline	Col 0-2, Height: 26
sysdigprocesscwd	Col 0-2, Height: 26
sysdigprocesssha256	Col 0-2, Height: 26
sysdigprocessparentname	Col 0-2, Height: 26
sysdigeventtype	Col 0-2, Height: 26
sysdigusername	Col 0-2, Height: 26
Falco Rule Output

Full Falco rule output
Field ID	Position
sysdigfalcooutput	Col 0-2, Height: 26
Legacy Sysdig Fields

Legacy Sysdig fields (populated via API enrichment)
Field ID	Position
sysdigagentid	Col 0-2, Height: 26
sysdigcustomerid	Col 0-2, Height: 26
Work Plan

Indicators

War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Canvas 0 sections
No sections defined.
Source

layoutscontainer-Sysdig_Incident.json
Download History Raw
{
    "detailsV2": {
        "tabs": [
            {
                "id": "summary",
                "name": "Legacy Summary",
                "type": "summary"
            },
            {
                "id": "caseinfoid",
                "name": "Incident Info",
                "sections": [
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "i": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
                        "isVisible": true,
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "type",
                                "height": 26,
                                "id": "incident-type-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "severity",
                                "height": 26,
                                "id": "incident-severity-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "owner",
                                "height": 26,
                                "id": "incident-owner-field",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sourcebrand",
                                "height": 26,
                                "id": "incident-sourceBrand-field",
                                "index": 4,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sourceinstance",
                                "height": 26,
                                "id": "incident-sourceInstance-field",
                                "index": 5,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "playbookid",
                                "height": 26,
                                "id": "incident-playbookId-field",
                                "index": 6,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "moved": false,
                        "name": "Case Details",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 0
                    },
                    {
                        "h": 2,
                        "i": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
                        "maxW": 3,
                        "moved": false,
                        "name": "Timeline Information",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 2,
                        "displayType": "CARD",
                        "items": [
                            {
                                "endCol": 1,
                                "fieldId": "occurred",
                                "height": 26,
                                "id": "incident-occurred-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 1,
                                "fieldId": "dbotmodified",
                                "height": 26,
                                "id": "incident-modified-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "dbotduedate",
                                "height": 26,
                                "id": "incident-dueDate-field",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "dbotcreated",
                                "height": 26,
                                "id": "incident-created-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 1
                            },
                            {
                                "endCol": 2,
                                "fieldId": "dbotclosed",
                                "height": 26,
                                "id": "incident-closed-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 1
                            }
                        ]
                    },
                    {
                        "h": 2,
                        "i": "caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
                        "maxW": 3,
                        "moved": false,
                        "name": "Notes",
                        "static": false,
                        "type": "notes",
                        "w": 1,
                        "x": 2,
                        "y": 0
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "i": "caseinfoid-sysdig-event-info",
                        "maxW": 3,
                        "moved": false,
                        "name": "Sysdig Event Info",
                        "static": false,
                        "w": 1,
                        "x": 1,
                        "y": 0,
                        "description": "Sysdig event identification and rule details",
                        "hideName": false,
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "sysdigeventid",
                                "height": 26,
                                "id": "sysdig-event-id-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigrulename",
                                "height": 26,
                                "id": "sysdig-rule-name-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigruletype",
                                "height": 26,
                                "id": "sysdig-rule-type-field",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigpolicyname",
                                "height": 26,
                                "id": "sysdig-policy-name-field",
                                "index": 3,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigpolicyid",
                                "height": 26,
                                "id": "sysdig-policy-id-field",
                                "index": 4,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigsource",
                                "height": 26,
                                "id": "sysdig-source-field",
                                "index": 5,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigorigin",
                                "height": 26,
                                "id": "sysdig-origin-field",
                                "index": 6,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigeventurl",
                                "height": 26,
                                "id": "sysdig-event-url-field",
                                "index": 7,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "minH": 1
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "caseinfoid-sysdig-container-host",
                        "maxW": 3,
                        "moved": false,
                        "name": "Container & Host",
                        "static": false,
                        "w": 1,
                        "x": 1,
                        "y": 2,
                        "description": "Container and host identification",
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "sysdigcontainerid",
                                "height": 26,
                                "id": "sysdig-container-id-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigcontainername",
                                "height": 26,
                                "id": "sysdig-container-name-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigcontainerimage",
                                "height": 26,
                                "id": "sysdig-container-image-field",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigcontainerimagetag",
                                "height": 26,
                                "id": "sysdig-container-image-tag-field",
                                "index": 3,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigcontainerimageid",
                                "height": 26,
                                "id": "sysdig-container-image-id-field",
                                "index": 4,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdighostid",
                                "height": 26,
                                "id": "sysdig-host-id-field",
                                "index": 5,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sourcehostname",
                                "height": 26,
                                "id": "sysdig-source-hostname-field",
                                "index": 6,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "macaddress",
                                "height": 26,
                                "id": "sysdig-mac-address-field",
                                "index": 7,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigagentversion",
                                "height": 26,
                                "id": "sysdig-agent-version-field",
                                "index": 8,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigagentvariant",
                                "height": 26,
                                "id": "sysdig-agent-variant-field",
                                "index": 9,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "minH": 1
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "i": "caseinfoid-sysdig-k8s-context",
                        "maxW": 3,
                        "moved": false,
                        "name": "Kubernetes Context",
                        "static": false,
                        "w": 1,
                        "x": 0,
                        "y": 4,
                        "description": "Kubernetes context",
                        "hideName": false,
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "sysdigk8sclustername",
                                "height": 26,
                                "id": "sysdig-k8s-cluster-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigk8snamespace",
                                "height": 26,
                                "id": "sysdig-k8s-namespace-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigk8spodname",
                                "height": 26,
                                "id": "sysdig-k8s-pod-field",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigk8snodename",
                                "height": 26,
                                "id": "sysdig-k8s-node-field",
                                "index": 3,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigk8sworkloadname",
                                "height": 26,
                                "id": "sysdig-k8s-workload-name-field",
                                "index": 4,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigk8sworkloadtype",
                                "height": 26,
                                "id": "sysdig-k8s-workload-type-field",
                                "index": 5,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "minH": 1
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "i": "caseinfoid-sysdig-cloud-context",
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "sysdigawsaccountid",
                                "height": 26,
                                "id": "sysdig-aws-account-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigawsregion",
                                "height": 26,
                                "id": "sysdig-aws-region-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigawsinstanceid",
                                "height": 26,
                                "id": "sysdig-aws-instance-field",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "moved": false,
                        "name": "Cloud Context",
                        "static": false,
                        "w": 1,
                        "x": 1,
                        "y": 4,
                        "description": "Cloud provider context",
                        "hideName": false,
                        "minH": 1
                    },
                    {
                        "description": "Process details from Falco event",
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "caseinfoid-sysdig-process-details",
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "sysdigprocessname",
                                "height": 26,
                                "id": "sysdig-proc-name-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigprocesscmdline",
                                "height": 26,
                                "id": "sysdig-proc-cmdline-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigprocesscwd",
                                "height": 26,
                                "id": "sysdig-proc-cwd-field",
                                "index": 2,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigprocesssha256",
                                "height": 26,
                                "id": "sysdig-proc-sha256-field",
                                "index": 3,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigprocessparentname",
                                "height": 26,
                                "id": "sysdig-proc-parent-field",
                                "index": 4,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigeventtype",
                                "height": 26,
                                "id": "sysdig-evt-type-field",
                                "index": 5,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigusername",
                                "height": 26,
                                "id": "sysdig-username-field",
                                "index": 6,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Process Details",
                        "static": false,
                        "w": 1,
                        "x": 2,
                        "y": 2
                    },
                    {
                        "description": "Full Falco rule output",
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "caseinfoid-sysdig-falco-output",
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "sysdigfalcooutput",
                                "height": 26,
                                "id": "sysdig-falco-output-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Falco Rule Output",
                        "static": false,
                        "w": 2,
                        "x": 0,
                        "y": 6
                    },
                    {
                        "description": "Legacy Sysdig fields (populated via API enrichment)",
                        "displayType": "ROW",
                        "h": 2,
                        "hideName": false,
                        "i": "caseinfoid-sysdig-legacy-fields",
                        "items": [
                            {
                                "endCol": 2,
                                "fieldId": "sysdigagentid",
                                "height": 26,
                                "id": "sysdig-legacy-agent-id-field",
                                "index": 0,
                                "sectionItemType": "field",
                                "startCol": 0
                            },
                            {
                                "endCol": 2,
                                "fieldId": "sysdigcustomerid",
                                "height": 26,
                                "id": "sysdig-legacy-customer-id-field",
                                "index": 1,
                                "sectionItemType": "field",
                                "startCol": 0
                            }
                        ],
                        "maxW": 3,
                        "minH": 1,
                        "moved": false,
                        "name": "Legacy Sysdig Fields",
                        "static": false,
                        "w": 1,
                        "x": 2,
                        "y": 4
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "i": "caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8",
                        "maxW": 3,
                        "moved": false,
                        "name": "Work Plan",
                        "static": false,
                        "type": "workplan",
                        "w": 1,
                        "x": 0,
                        "y": 8
                    },
                    {
                        "displayType": "ROW",
                        "h": 2,
                        "i": "caseinfoid-7ce69dd0-a07f-11e9-936c-5395a1acf11e",
                        "maxW": 3,
                        "moved": false,
                        "name": "Indicators",
                        "query": "",
                        "queryType": "input",
                        "static": false,
                        "type": "indicators",
                        "w": 2,
                        "x": 0,
                        "y": 10
                    }
                ],
                "type": "custom"
            },
            {
                "id": "warRoom",
                "name": "War Room",
                "type": "warRoom"
            },
            {
                "id": "workPlan",
                "name": "Work Plan",
                "type": "workPlan"
            },
            {
                "id": "canvas",
                "name": "Canvas",
                "type": "canvas"
            }
        ]
    },
    "group": "incident",
    "id": "Sysdig Incident",
    "name": "Sysdig Incident",
    "system": false,
    "version": -1,
    "fromVersion": "6.0.0",
    "marketplaces": [
        "xsoar",
        "marketplacev2",
        "xsoar_saas",
        "platform"
    ],
    "description": ""
}