Use Case Builder
Use Case Builder Incident
Details
| ID | Use Case Builder |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.8.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Use Case Builder 9 sections
Use Case Definition
| Field ID | Position |
|---|---|
| usecasename | Col 0-4, Height: 106 |
| usecasepurpose | Col 0-4, Height: 106 |
| trigger | Col 0-4, Height: 106 |
| incidentstructureandmapping | Col 0-4, Height: 106 |
| incidentresponseprocess | Col 0-4, Height: 106 |
| enrichment | Col 0-4, Height: 106 |
| manualsteps | Col 0-4, Height: 106 |
| enduserinteractiveness | Col 0-4, Height: 106 |
| deduplicationlogic | Col 0-4, Height: 106 |
| thirdpartyintegrations | Col 0-4, Height: 106 |
| incident_customincidentdatastructure | Col 0-2, Height: 53 |
Work Plan
Incident Classification
If you want to generate a use case using OOTB Content, select one of the use case categories below (Example, Phishing). Then Click the Generate Use Case Button
| Field ID | Position |
|---|---|
| customername | Col 0-1, Height: 53 |
| usecasecategory | Col 1-2, Height: 53 |
| usecaseinitiator | Col 2-4, Height: 53 |
Analysis Sub Playbooks
| Field ID | Position |
|---|---|
| usecaserequiredmetricsandnotifications | Col 0-2, Height: 22 |
| usecaseenrichmentsteps | Col 0-2, Height: 22 |
Containment Subplaybooks
| Field ID | Position |
|---|---|
| incident_usecasebuilderusecasecontainmentsteps | Col 0-2, Height: 22 |
New Section
| Field ID | Position |
|---|---|
| usecaseadoptionmetrics | Col 0-2, Height: 44 |
SLAs
| Field ID | Position |
|---|---|
| usecaseslas | Col 0-6, Height: 53 |
Welcome to XSOAR
Use Case Development Deadline
| Field ID | Position |
|---|---|
| usecasepriority | Col 0-2, Height: 53 |
| usecasedevelopmentstage | Col 0-2, Height: 53 |
| usecasebuilderdevelopmentdeadline | Col 0-2, Height: 53 |
Use Case Definition Report 6 sections
Use Case Definition
| Field ID | Position |
|---|---|
| usecasename | Col 0-6, Height: 106 |
| usecasepurpose | Col 0-6, Height: 106 |
| usecaseenrichmentsteps | Col 0-2, Height: 53 |
| trigger | Col 0-6, Height: 106 |
| incidentstructureandmapping | Col 0-6, Height: 106 |
| incidentresponseprocess | Col 0-6, Height: 106 |
| enrichment | Col 0-6, Height: 106 |
| manualsteps | Col 0-6, Height: 106 |
| enduserinteractiveness | Col 0-6, Height: 106 |
| deduplicationlogic | Col 0-6, Height: 106 |
| thirdpartyintegrations | Col 0-6, Height: 106 |
| incident_customincidentdatastructure | Col 0-2, Height: 53 |
Incident Classification
| Field ID | Position |
|---|---|
| customername | Col 0-1, Height: 53 |
| usecasecategory | Col 1-2, Height: 53 |
| usecaseinitiator | Col 2-4, Height: 53 |
Analysis Sub Playbooks
| Field ID | Position |
|---|---|
| usecaserequiredmetricsandnotifications | Col 0-2, Height: 22 |
Containment Subplaybooks
| Field ID | Position |
|---|---|
| incident_usecasebuilderusecasecontainmentsteps | Col 0-2, Height: 22 |
SLAs
| Field ID | Position |
|---|---|
| usecaseslas | Col 0-6, Height: 53 |
Use Case Development Deadline
| Field ID | Position |
|---|---|
| usecasepriority | Col 0-2, Height: 53 |
| usecasedevelopmentstage | Col 0-2, Height: 53 |
| usecasebuilderdevelopmentdeadline | Col 0-2, Height: 53 |
Getting Started 2 sections
XSOAR in 5 minutes
New Section
| Field ID | Position |
|---|---|
| usecasebuildergettingstarted | Col 0-4, Height: 106 |
Common Use Cases 11 sections
New Section
| Field ID | Position |
|---|---|
| usecasebuilderendpoint | Col 0-2, Height: 44 |
New Section
| Field ID | Position |
|---|---|
| usecasebuilderdataenrichmentandthreatintelligence | Col 0-2, Height: 106 |
New Section
| Field ID | Position |
|---|---|
| usecasebuildercasemanagement | Col 0-2, Height: 22 |
New Section
| Field ID | Position |
|---|---|
| usecasebuilderiam | Col 0-2, Height: 22 |
New Section
| Field ID | Position |
|---|---|
| usecasebuildervulnerabilitymanagement | Col 0-2, Height: 22 |
New Section
| Field ID | Position |
|---|---|
| networksecurityids | Col 0-2, Height: 22 |
New Section
| Field ID | Position |
|---|---|
| usecasebuildernetworksecurityngfw | Col 0-2, Height: 106 |
New Section
| Field ID | Position |
|---|---|
| usecasebuilderforensicsandmalwareanalysis | Col 0-2, Height: 44 |
New Section
| Field ID | Position |
|---|---|
| usecasebuilderemailgateway | Col 0-2, Height: 44 |
New Section
| Field ID | Position |
|---|---|
| usecasebuilderauthentication | Col 0-2, Height: 44 |
New Section
| Field ID | Position |
|---|---|
| usecasebuilderseim | Col 0-2, Height: 44 |
XSOAR Incident Flow 1 section
XSOAR Incident Flow
This shows the typical XSOAR Incident process. Alerts are ingested and categorized via Incident type, then playbooks are run to enrich, calculate alert severity, send notifications, etc. Then an analyst will review prior to containing or performing remediation steps.
| Field ID | Position |
|---|---|
| xsoarincidentflow | Col 0-6, Height: 106 |
Best Practice 3 sections
New Section
| Field ID | Position |
|---|---|
| usecasetimbestpractice | Col 0-2, Height: 106 |
New Section
| Field ID | Position |
|---|---|
| usecasedesignbestpractice | Col 0-6, Height: 106 |
New Section
| Field ID | Position |
|---|---|
| usecaseingestionbestpractice | Col 0-4, Height: 106 |
Downloads 1 section
Use Cases
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Incident Info 11 sections
Case Details
| Field ID | Position |
|---|---|
| type | Col 0-2, Height: 22 |
| severity | Col 0-2, Height: 22 |
| owner | Col 0-2, Height: 22 |
| sourcebrand | Col 0-2, Height: 22 |
| sourceinstance | Col 0-2, Height: 22 |
| playbookid | Col 0-2, Height: 22 |
Notes
Work Plan
Linked Incidents
Child Incidents
Evidence
Team Members
Indicators
Timeline Information
| Field ID | Position |
|---|---|
| occurred | Col 0-1, Height: 22 |
| dbotmodified | Col 0-1, Height: 22 |
| dbotduedate | Col 0-2, Height: 22 |
| dbotcreated | Col 1-2, Height: 22 |
| dbotclosed | Col 1-2, Height: 22 |
Closing Information
| Field ID | Position |
|---|---|
| dbotclosed | Col 0-2, Height: 22 |
| closereason | Col 0-2, Height: 22 |
| closenotes | Col 0-2, Height: 22 |
Investigation Data
| Field ID | Position |
|---|---|
| details | Col 0-2, Height: 22 |
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.