Core Alert Fields (v1.0.51)
This Content Pack will provide you with the core alert fields.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Endpoint
Incident fields (104)
- Action
- Action Process Instance ID
- Actor Process Instance ID
- Agent Id
- Agent OS Sub Type
- Alert Search Results
- App Category
- App Technology
- App-id
- CGO CMD
- CGO MD5
- CGO SHA256
- CGO name
- CGO path
- CGO signature
- CGO signer
- CID
- Category Name
- Cloud Identity Sub Type
- Cloud Identity Type
- Cloud Operation Type
- Cloud Project
- Cloud Provider
- Cloud Referenced Resource
- Cloud Resource Sub-type
- Cloud Resource Type
- Cluster Name
- Container ID
- Contains Featured Host
- Contains Featured IP Address
- Contains Featured User
- Country
- DNS Query Name
- Destination Zone Name
- Domain
- Email Recipient
- Email Sender
- Email Subject
- Event Type
- Excluded
- FW Name
- FW Rule ID
- FW Rule Name
- FW Serial Number
- File MD5
- File Macro SHA256
- File Name
- File SHA256
- File path
- Host FQDN
- Host IP
- Host Mac Address
- Host OS
- Host Risk Level
- Host Risk Reasons
- Hostname
- Image Name
- Initiated By
- Initiator CMD
- Initiator MD5
- Initiator PID
- Initiator SHA256
- Initiator TID
- Initiator path
- Initiator signature
- Initiator signer
- Is Phishing
- Local IP
- Local Port
- Misc
- Mitre ATT&CK Tactic
- Mitre ATT&CK Technique
- Module
- NGFW Vsys Name
- OS Parent CMD
- OS Parent ID
- OS Parent Name
- OS Parent PID
- OS Parent SHA256
- OS Parent Signature
- OS Parent Signer
- OS Parent User Name
- Process execution signature
- Process execution signer
- Registry Data
- Registry Full Key
- Remote Agent Hostname
- Remote Host
- Remote IP
- Remote Port
- Rule ID
- Source Zone Name
- Starred
- Target process CMD
- Target process SHA256
- Target process name
- Timestamp
- URL
- User Agent
- User Risk Level
- User Risk Reasons
- User name
- XFF
- appsubcategory