Common Types (v3.10.15)

This Content Pack will get you up and running in no-time and provide you with the most commonly used incident & indicator fields and types.

Author

Cortex XSOAR

Support

xsoar

URL

https://www.paloaltonetworks.com/cortex

Categories

Utilities

Incident fields (440)

• ASN
• ASN Name
• Account ID
• Account Member Of
• Account Name
• Account Status
• Acquisition Hire
• Additional Data
• Additional Email Addresses
• Additional Indicators
• Affected Hosts
• Affected Users
• Agent ID
• Agent Version
• Agents ID
• Alert Acknowledgement
• Alert Action
• Alert Attack Time
• Alert Category
• Alert ID
• Alert Malicious
• Alert Name
• Alert Rules
• Alert Source
• Alert Type ID
• Alert URL
• Alert tags
• App
• App message
• Appliance ID
• Appliance Name
• Application Id
• Application Name
• Application Path
• Approval Status
• Approver
• Asset ID
• Asset Name
• Assigned User
• Assignment Group
• Attack Mode
• Attack Patterns
• Audit Logs
• Birthday
• Block Indicators Status
• Blocked Action
• Bugtraq
• CMD
• CMD line
• CVE
• CVE ID
• CVE Published
• CVSS
• CVSS Availability Requirement
• CVSS Collateral Damage Potential
• CVSS Confidentiality Requirement
• CVSS Integrity Requirement
• Caller
• Campaign Name
• Categories
• Category Count
• Changed
• Child Process
• City
• Classification
• Close Time
• Closing Reason
• Closing User
• Cloud Account ID
• Cloud Instance ID
• Cloud Operation Type
• Cloud Region List
• Cloud Resource List
• Cloud Service
• Command Line
• Command Line Verdict
• Comment
• Compliance Notes
• Containment SLA
• Cost Center
• Cost Center Code
• Country
• Country Code
• Country Code Number
• Country Name
• Critical Assets
• Custom Query Results
• DNS Name
• Department
• Description
• Dest
• Dest Hostname
• Dest NT Domain
• Dest OS
• Destination Geolocation
• Destination Hostname
• Destination IP
• Destination IPV6
• Destination IPs
• Destination MAC Address
• Destination Network
• Destination Networks
• Destination Port
• Detected Endpoints
• Detected External Hosts
• Detected External IPs
• Detected IPs
• Detected Internal Hosts
• Detected Internal IPs
• Detected User
• Detected Users
• Detection End Time
• Detection ID
• Detection SLA
• Detection URL
• Detection Update Time
• Device External IP
• Device External IPs
• Device Hash
• Device Id
• Device Internal IPs
• Device Local IP
• Device MAC Address
• Device Model
• Device Name
• Device OS Name
• Device OS Version
• Device OU
• Device Status
• Device Time
• Device Username
• Display Name
• Domain Name
• Domain Registrar Abuse Email
• Domain Squatting Result
• Domain Updated Date
• Dst Ports
• Dsts
• Duration
• Email
• Email Sent Successfully
• EmailCampaignCanvas
• EmailCampaignMutualIndicators
• EmailCampaignSnippets
• EmailCampaignSummary
• Employee Display Name
• Employee Email
• Employee Manager Email
• End Time
• Endpoint
• Endpoint Isolation Status
• Endpoints Details
• Error Code
• Error Message
• Escalation
• Event Action
• Event Descriptions
• Event ID
• Event Names
• Event Type
• Events
• Exposure Level
• External Addresses
• External Category ID
• External Category Name
• External Confidence
• External End Time
• External ID
• External Last Updated Time
• External Link
• External Severity
• External Start Time
• External Status
• External Sub Category ID
• External Sub Category Name
• External System ID
• Failed Logon Events
• Failed Logon Events Timeframe
• File Access Date
• File Creation Date
• File Hash
• File MD5
• File Name
• File Names
• File Path
• File Paths
• File Relationships
• File SHA1
• File SHA256
• File Size
• File Upload
• First Name
• First Seen
• Follow Up
• Full Name
• Given Name
• Group ID
• High Level Categories
• High Risky Hosts
• High Risky Users
• Hostnames
• Hunt Results Count
• IP Blocked Status
• IP Reputation
• Identity Type
• Incident Duration
• Incident Link
• IncomingMirrorError
• Internal Addresses
• Investigation Stage
• Is Active
• Isolated
• Item Owner
• Item Owner Email
• Job Code
• Job Family
• Job Function
• Last Mirrored Time Stamp
• Last Modified By
• Last Modified On
• Last Name
• Last Seen
• Last Update Time
• Leadership
• List Of Rules - Event
• Location
• Location Region
• Log Source
• Log Source Name
• Log Source Type
• Low Level Categories Events
• MAC Address
• MD5
• MITRE Tactic ID
• MITRE Tactic Name
• MITRE Technique ID
• MITRE Technique Name
• Macro Source Code
• Manager Email Address
• Manager Name
• Mobile Device Model
• Mobile Phone
• Number Of Found Related Alerts
• Number Of Log Sources
• Number of Related Incidents
• Number of similar files
• OS
• OS Type
• OS Version
• Objective
• Operation Name
• Org Level 1
• Org Level 2
• Org Level 3
• Org Unit
• Original Alert ID
• Original Alert Name
• Original Alert Source
• Original Description
• Original Events
• OutgoingMirrorError
• PID
• Parent CMD line
• Parent Process
• Parent Process CMD
• Parent Process File Path
• Parent Process IDs
• Parent Process MD5
• Parent Process Name
• Parent Process Path
• Parent Process SHA256
• Part of Campaign
• Password Changed Date
• Password Reset Successfully
• Personal Email
• Phone Number
• Policy Actions
• Policy Deleted
• Policy Description
• Policy Details
• Policy ID
• Policy Recommendation
• Policy Remediable
• Policy Severity
• Policy Type
• Policy URI
• Post Nat Destination IP
• Post Nat Destination Port
• Post Nat Source IP
• Post Nat Source Port
• Pre Nat Destination Port
• Pre Nat Source IP
• Pre Nat Source Port
• Process CMD
• Process Creation Time
• Process ID
• Process MD5
• Process Name
• Process Names
• Process Path
• Process Paths
• Process SHA256
• Project ID
• Protocol
• Protocol - Event
• Protocol names
• Protocols
• Rating
• Raw Event
• Referenced Resource ID
• Referenced Resource Name
• Region
• Region ID
• Registration Email
• Registry Hive
• Registry Key
• Registry Value
• Registry Value Type
• Related Alerts
• Related Campaign
• Related Endpoints
• Related Report
• Remediation SLA
• RemovedFromCampaigns
• Rendered HTML
• Report Name
• Reporter Email Address
• Resource ID
• Resource Name
• Resource Type
• Resource URL
• Risk Name
• Risk Rating
• Risk Score
• Rule Name
• SHA1
• SHA256
• SHA512
• SKU Name
• SKU TIER
• SSDeep
• Scenario
• Selected Indicators
• Sensor IP
• Sensor Name
• Signature
• Similar incidents Dbot
• Source Category
• Source Create time
• Source Created By
• Source External IPs
• Source Geolocation
• Source Hostname
• Source IP
• Source IPV6
• Source IPs
• Source Id
• Source MAC Address
• Source Network
• Source Networks
• Source Port
• Source Priority
• Source Status
• Source Updated by
• Source Urgency
• Source Username
• Src
• Src Hostname
• Src NT Domain
• Src OS
• Src Ports
• Src User
• Srcs
• Start Time
• State
• Status Reason
• Street Address
• String Similarity Results
• Sub Category
• Subtype
• Surname
• Suspicious Executions
• Suspicious Executions Found
• Tactic
• Tactic ID
• Tags
• Team name
• Technical Owner
• Technical Owner Contact
• Technical User
• Technique
• Technique ID
• Tenant Name
• Threat Family Name
• Threat Hunting Detected Hostnames
• Threat Hunting Detected IP
• Threat Name
• Ticket Acknowledged Date
• Ticket Closed Date
• Ticket Number
• Ticket Opened Date
• Time to Assignment
• Timezone
• Title
• Tool Usage Found
• Tools
• Traffic Direction
• Triage SLA
• Triggered Security Profile
• URL SSL Verification
• URLs
• UUID
• Unique Ports
• Use Case Description
• User Agent
• User Anomaly Count
• User Block Status
• User Creation Time
• User Engagement Response
• User Groups
• User Id
• User Risk Level
• User SID
• Username
• Usernames
• Users
• Users Details
• Vendor ID
• Vendor Product
• Verdict
• Verification Method
• Verification Status
• Vulnerability Category
• Vulnerable Product
• Work Phone
• Zip Code
• app channel name
• sAMAccountName
• similarIncidents
• userAccountControl

Indicator fields (235)

• AS Owner
• ASN
• Account Type
• Acquisition Hire
• Action
• Actor
• Admin Country
• Admin Email
• Admin Name
• Admin Phone
• Aliases
• Applications
• Architecture
• Assigned role
• Assigned user
• Associated File Names
• Associations
• Author
• BIOS Version
• Behavior
• Blocked
• CPE
• CVE Description
• CVE Modified
• CVSS
• CVSS Score
• CVSS Table
• CVSS Vector
• CVSS Version
• CVSS3
• Campaign
• Capabilities
• Category
• Certificate Names
• Certificate Signature
• Certificate Validation Checks
• Certificates
• City
• Commands
• Community Notes
• Confidence
• Cost Center
• Cost Center Code
• Country Code
• Country Code Number
• Country Name
• Creation Date
• DHCP Server
• DNS
• DNS Records
• Definition
• Department
• Description
• Detection Engines
• Detections
• Device Model
• Display Name
• Domain IDN Name
• Domain Name
• Domain Referring IPs
• Domain Referring Subnets
• Domain Status
• Domains
• Download URL
• Email
• Email Address
• Entry ID
• Expiration Date
• Extension
• Feed Related Indicators
• File Extension
• File Type
• First Seen By Source
• Force Sync
• Geo Country
• Geo Location
• Given Name
• Global Prevalence
• Goals
• Groups
• Hostname
• IP Address
• Identity class
• Implementation Languages
• Indicator Identification
• Industry sectors
• Infrastructure Types
• Internal
• Is Malware Family
• Is Processed
• Issuer
• Issuer DN
• Job Code
• Job Family
• Job Function
• Key Value
• Kill Chain Phases
• Languages
• Last Seen By Source
• Leadership
• Location
• Location Region
• MAC Address
• MD5
• Malware Family
• Malware types
• Manager Email Address
• Manager Name
• Memory
• Mitre ID
• Mitre Tactics
• Mobile Phone
• Name
• Name Field
• Name Servers
• Number of subkeys
• OS Version
• Objective
• Office365Category
• Office365ExpressRoute
• Office365Required
• Operating System
• Operating System Refs
• Operating System Version
• Org Level 1
• Org Level 2
• Org Level 3
• Org Unit
• Organization
• Organization First Seen
• Organization Last Seen
• Organization Prevalence
• Organization Type
• Organizational Unit (OU)
• PEM
• Path
• Paths
• Personal Email
• Port
• Positive Detections
• Primary Motivation
• Processor
• Processors
• Product
• Public Key
• Publications
• Published
• Quarantined
• Query Language
• Rank
• Region
• Registrant Country
• Registrant Email
• Registrant Name
• Registrant Phone
• Registrar Abuse Address
• Registrar Abuse Country
• Registrar Abuse Email
• Registrar Abuse Name
• Registrar Abuse Network
• Registrar Abuse Phone
• Registrar Name
• Report Object References
• Report type
• Reported By
• Reports
• Resource Level
• Roles
• SHA1
• SHA256
• SHA512
• SPKI SHA256
• SSDeep
• STIX Aliases
• STIX Description
• STIX Goals
• STIX ID
• STIX Is Malware Family
• STIX Kill Chain Phases
• STIX Malware Types
• STIX Primary Motivation.
• STIX Resource Level
• STIX Roles
• STIX Secondary Motivations
• STIX Sophistication
• STIX Threat Actor Types
• STIX Tool Types
• STIX Tool Version
• SWID
• Samples
• Secondary Motivations
• Serial Number
• Service
• Short Description
• Signature Algorithm
• Signature Authentihash
• Signature Copyright
• Signature Description
• Signature File Version
• Signature Internal Name
• Signature Original Name
• Signed
• Size
• Sophistication
• Source Original Severity
• Source Priority
• State
• Street Address
• Subdomains
• Subject
• Subject Alternative Names
• Subject DN
• Surname
• Tags
• Targets
• Threat Actor Types
• Threat Types
• Title
• Tool Types
• Tool Version
• Traffic Light Protocol
• Updated Date
• User ID
• Username
• Validity Not After
• Validity Not Before
• Vendor
• Version
• Vulnerabilities
• Vulnerable Products
• Whois Records
• Work Phone
• X.509 v3 Extensions
• Zip Code
• imphash

Indicator types (34)

• ASN
• Account
• Attack Pattern
• CIDR
• CVE
• Campaign
• Course of Action
• Domain
• DomainGlob
• Email
• File
• File MD5
• File SHA-1
• File SHA-256
• Host
• IP
• IPv6
• IPv6CIDR
• Identity
• Infrastructure
• Intrusion Set
• Location
• Malware
• Mutex
• Onion Address
• Registry Key
• Report
• Software
• Tactic
• Threat Actor
• Tool
• URL
• X509 Certificate
• ssdeep

Layout rules (2)

• Indicator Feed Layout Rule
• Vulnerability Layout Rule

Layouts (29)

• ASN
• Account Indicator
• Attack Pattern
• CVE Indicator
• Campaign
• Campaign
• Course of Action
• Domain Indicator
• Email Indicator
• File Indicator
• Host Indicator
• IP Indicator
• Identity
• Indicator Feed Incident
• Infrastructure
• Intrusion Set
• Location
• Malware Indicator
• Malware Indicator
• Mutex
• Registry Key Indicator
• Report
• Software
• Tactic Layout
• Threat Actor
• Tool Indicator
• URL Indicator
• Vulnerability Incident
• X509 Certificate