{
"cronView": false,
"decoder": {
"evidences.fetched": {
"type": "date",
"value": "02/01/06 3:04:05 PM"
},
"evidences.markedDate": {
"type": "date",
"value": "02/01/06 3:04:05 PM"
},
"evidences.occurred": {
"type": "date",
"value": "02/01/06 3:04:05 PM"
},
"incident.activated": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"incident.closed": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"incident.created": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"incident.dbotStatus.0": {
"type": "string",
"value": "Pending"
},
"incident.dbotStatus.1": {
"type": "string",
"value": "Active"
},
"incident.dbotStatus.2": {
"type": "string",
"value": "Closed"
},
"incident.dbotStatus.3": {
"type": "string",
"value": "Closed"
},
"incident.dbotStatus.4": {
"type": "string",
"value": "On Hold"
},
"incident.dueDate": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"incident.modified": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"incident.occurred": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"incident.openDuration": {
"type": "duration",
"value": ""
},
"incident.phase.": {
"type": "string",
"value": "Unassigned"
},
"incident.reminder": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"incident.roles.": {
"type": "string",
"value": "Unassigned"
},
"incident.severity.0": {
"type": "string",
"value": "Unknown"
},
"incident.severity.0.5": {
"type": "string",
"value": "Informational"
},
"incident.severity.1": {
"type": "string",
"value": "Low"
},
"incident.severity.2": {
"type": "string",
"value": "Medium"
},
"incident.severity.3": {
"type": "string",
"value": "High"
},
"incident.severity.4": {
"type": "string",
"value": "Critical"
},
"incident.status.0": {
"type": "string",
"value": "Pending"
},
"incident.status.1": {
"type": "string",
"value": "Active"
},
"incident.status.2": {
"type": "string",
"value": "Closed"
},
"incident.status.3": {
"type": "string",
"value": "Closed"
},
"incident.status.4": {
"type": "string",
"value": "On Hold"
},
"incident.totalTime": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"indicators.firstSeen": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"indicators.lastSeen": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"indicators.score.0": {
"type": "string",
"value": "None"
},
"indicators.score.1": {
"type": "string",
"value": "Good"
},
"indicators.score.2": {
"type": "string",
"value": "suspicious"
},
"indicators.score.3": {
"type": "string",
"value": "Bad"
},
"investigation.closed": {
"type": "date",
"value": "02 Jan 2006"
},
"investigation.created": {
"type": "date",
"value": "Mon, 02 Jan 2006 15:04:05 MST"
},
"investigation.openDuration": {
"type": "duration",
"value": ""
},
"investigation.status.0": {
"type": "string",
"value": "Active"
},
"investigation.status.1": {
"type": "string",
"value": "Done"
},
"investigation.type.0": {
"type": "string",
"value": "Standard"
},
"investigation.type.1": {
"type": "string",
"value": "Restricted"
},
"investigation.type.9": {
"type": "string",
"value": "Playground"
}
},
"sections": [
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzNCIgaGVpZ2h0PSIzNCIgdmlld0JveD0iMCAwIDM0IDM0Ij4gIDxnIGZpbGw9Im5vbmUiIGZpbGwtcnVsZT0iZXZlbm9kZCI+ICAgIDxwb2x5Z29uIGZpbGw9IiMzODM4M0QiIHBvaW50cz0iMjQuMzU5IDI0LjMwNSAzNC4wMTUgMzQuMDE2IDMzLjk5NCAxNC43NzIiLz4gICAgPHBvbHlnb24gZmlsbD0iIzk1QzgzRCIgcG9pbnRzPSIzMy45OTUgMCAwIC4wMTQgMjIuNzc3IDIyLjg1OCAzMy45MzYgMTEuNTI1Ii8+ICA8L2c+PC9zdmc+",
"layout": {
"class": "fixed",
"columnPos": 0,
"h": 1,
"i": "2cba731e-c580-44a6-9c25-e474295158f5",
"rowPos": 0,
"style": {
"position": "fixed",
"right": -1,
"top": 0
},
"w": 12
},
"query": {},
"titleStyle": null,
"type": "image",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": null,
"layout": {
"columnPos": 6,
"h": 1,
"i": "51de8bfd-fb30-481f-afe0-a524e38a4867",
"rowPos": 1,
"style": {
"float": "right",
"height": 40,
"marginTop": 10,
"width": "auto"
},
"w": 6
},
"query": {
"type": "customer"
},
"titleStyle": null,
"type": "logo",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": null,
"layout": {
"columnPos": 0,
"h": 1,
"i": "c85c425b-9f0e-4e34-82ef-208ae2d4a4a1",
"rowPos": 1,
"style": {
"height": 35,
"marginTop": 10,
"padding": 5,
"width": "auto"
},
"w": 6
},
"query": {},
"titleStyle": null,
"type": "logo",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": "{0} #{1}",
"layout": {
"columnPos": 0,
"h": 1,
"i": "94bc90ae-d1ef-4ec1-99ee-779bfc19061d",
"rowPos": 2,
"style": {
"color": "#4e6767",
"fontSize": 22,
"textAlign": "left"
},
"w": 12
},
"query": {
"filter": "investigation",
"keys": [
"name",
"id"
],
"type": "sessionData"
},
"titleStyle": null,
"type": "placeholder",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": null,
"layout": {
"columnPos": 0,
"h": 1,
"i": "581de1ac-d26e-4e28-992b-8bc6dbee4fea",
"rowPos": 3,
"style": {
"fontSize": 14,
"marginBottom": 12,
"textAlign": "left"
},
"w": 12,
"format": "MMMM Do YYYY, h:mm:ss a z",
"useCurrentTime": true
},
"query": {},
"titleStyle": null,
"type": "date",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": "Generated by: {0}",
"layout": {
"columnPos": 0,
"h": 1,
"i": "05d69815-e93f-4d34-8c9b-eff980eedb26",
"rowPos": 4,
"rowStyle": {
"marginTop": -20
},
"style": {
"fontSize": 14,
"textAlign": "left"
},
"w": 12
},
"query": {
"filter": "sessionUser",
"keys": [
"name"
],
"type": "sessionData"
},
"titleStyle": null,
"type": "placeholder",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": [
{
"displayType": "row",
"endCol": 6,
"fieldId": "severity",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 0,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "type",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 1,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "owner",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 2,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "roles",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 3,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "dbotcreated",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 4,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "occurred",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 5,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "dbotmodified",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 6,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "dbotduedate",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 7,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "dbottotaltime",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 8,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "dbotclosed",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 9,
"startCol": 0
}
],
"displayType": "row",
"layout": {
"columnPos": 0,
"h": 3,
"i": "v5dejmwwyv-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
"rowPos": 6,
"w": 12
},
"query": {
"type": "incident"
},
"title": "Case Details",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "itemsSection",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": null,
"emptyNotification": "No entries were found for the following filter: \"\"",
"layout": {
"columnPos": 4,
"h": 2,
"i": "v5dejmwwyv-caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
"rowPos": 22,
"w": 8
},
"query": {
"filter": {
"categories": [
"notes"
],
"pageSize": 10000
},
"type": "entries"
},
"title": "Notes",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "placeholder",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": null,
"displayType": "row",
"emptyNotification": "This incident is not linked to any other incidents.",
"layout": {
"columnPos": 0,
"h": 2,
"i": "v5dejmwwyv-caseinfoid-770ec200-98b1-11e9-97d7-ed26ef9e46c8",
"readableHeaders": {
"closeNotes": "Close Notes",
"id": "ID",
"name": "Name",
"status": "Status",
"type": "Type"
},
"rowPos": 20,
"tableColumns": [
{
"isDefault": true,
"key": "id",
"position": 0,
"width": 110
},
{
"hidden": false,
"isDefault": true,
"key": "name",
"position": 2,
"width": 262
},
{
"hidden": false,
"isDefault": true,
"key": "type",
"position": 3,
"width": 200
},
{
"isDefault": true,
"key": "status",
"position": 5,
"width": 80
},
{
"hidden": false,
"isDefault": true,
"key": "closeNotes",
"position": 18,
"width": 300
}
],
"w": 12
},
"query": {
"filter": {},
"type": "linkedIncidents"
},
"title": "Linked Incidents",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "table",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": null,
"displayType": "row",
"emptyNotification": "This incident does not contain evidence.",
"layout": {
"columnPos": 0,
"h": 2,
"i": "v5dejmwwyv-caseinfoid-4a31afa0-98ba-11e9-a519-93a53c759fe0",
"readableHeaders": {
"description": "Description",
"markedBy": "Submitter",
"occurred": "Occurred",
"tags": "Tags"
},
"rowPos": 18,
"tableColumns": [
{
"isDefault": true,
"key": "occurred",
"position": 1,
"width": 200
},
{
"isDefault": true,
"key": "description",
"position": 2,
"width": 300
},
{
"isDefault": true,
"key": "markedBy",
"position": 3,
"width": 150
},
{
"isDefault": true,
"key": "tags",
"position": 4,
"width": 400
}
],
"w": 12
},
"query": {
"filter": {},
"type": "evidences"
},
"title": "Evidence",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "table",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": null,
"displayType": "row",
"layout": {
"columnPos": 0,
"h": 2,
"i": "v5dejmwwyv-caseinfoid-7717e580-9bed-11e9-9a3f-8b4b2158e260",
"rowPos": 22,
"tableColumns": [
"Avatar",
"Name",
"Email"
],
"w": 4
},
"query": {
"filter": "investigationUsers",
"type": "sessionData"
},
"title": "Team Members",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "list",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": null,
"displayType": "row",
"emptyNotification": "This incident does not contain any indicators that apply to the following filter: \"\".",
"layout": {
"columnPos": 0,
"h": 2,
"i": "v5dejmwwyv-caseinfoid-7ce69dd0-a07f-11e9-936c-5395a1acf11e",
"readableHeaders": {
"indicator_type": "Type",
"score": "Reputation",
"sourceBrands": "Source Brands",
"value": "Value"
},
"rowPos": 16,
"tableColumns": [
{
"displayed": true,
"isDefault": true,
"key": "indicator_type",
"width": 120
},
{
"displayed": true,
"isDefault": true,
"key": "value",
"width": 300
},
{
"displayed": true,
"isDefault": true,
"key": "score",
"width": 120
},
{
"displayed": true,
"isDefault": true,
"key": "sourceBrands",
"width": 175
}
],
"w": 12
},
"query": {
"filter": {
"query": "investigationIDs:{{.investigationID}}"
},
"type": "indicators"
},
"title": "Indicators",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "table",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": [
{
"displayType": "row",
"endCol": 6,
"fieldId": "dbotclosed",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 0,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "closereason",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 1,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "closenotes",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 2,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "closinguserid",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 3,
"startCol": 0
}
],
"displayType": "row",
"layout": {
"columnPos": 0,
"h": 2,
"i": "v5dejmwwyv-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289",
"rowPos": 14,
"w": 12
},
"query": {
"type": "incident"
},
"title": "Closing Information",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "itemsSection",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": [
{
"displayType": "row",
"endCol": 6,
"fieldId": "details",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 0,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "playbookid",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 1,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "dbotsource",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 2,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "sourceinstance",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 3,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "sourcebrand",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 4,
"startCol": 0
},
{
"displayType": "row",
"endCol": 6,
"fieldId": "droppedcount",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 5,
"startCol": 0
}
],
"displayType": "row",
"layout": {
"columnPos": 0,
"h": 3,
"i": "v5dejmwwyv-caseinfoid-e54b1770-a0b1-11e9-b27f-13ae1773d289",
"rowPos": 9,
"w": 12
},
"query": {
"type": "incident"
},
"title": "Investigation Details",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "itemsSection",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": [
{
"displayType": "row",
"endCol": 2,
"fieldId": "labels",
"headerStyle": {
"color": "rgba(64, 65, 66, 0.7)",
"fontSize": "12px",
"fontWeight": 700
},
"index": 0,
"startCol": 0
}
],
"displayType": "row",
"layout": {
"columnPos": 0,
"h": 2,
"i": "v5dejmwwyv-caseinfoid-2bef1500-a0f2-11ea-a9ea-3d6524d9ea90",
"rowPos": 12,
"w": 12
},
"query": {
"type": "labels"
},
"title": "Labels",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "itemsSection",
"autoPageBreak": false
},
{
"automation": {
"args": null,
"id": "",
"name": "",
"noEvent": false
},
"data": [],
"emptyNotification": "No entries were found for the following filter: \"[object Object]\"",
"layout": {
"columnPos": 0,
"h": 1,
"i": "v5dejmwwyv-caseinfoid-5f87e5c0-a4e1-11ea-8c29-db553c036fb9",
"rowPos": 24,
"w": 12
},
"query": {
"filter": {
"categories": [
"chats"
],
"fromTime": "0001-01-01T00:00:00Z",
"pageSize": 0,
"tagsAndOperator": false,
"usersAndOperator": false
},
"type": "entries"
},
"title": "War Room Chat",
"titleStyle": {
"borderBottom": "1px solid rgba(64, 65, 66, 0.16)",
"color": "#768BA1"
},
"type": "placeholder",
"autoPageBreak": false
}
],
"disableHeader": true,
"endingDate": "0001-01-01T00:00:00Z",
"id": "CaseReport",
"description": "Investigation Summary Report from Case Management Pack",
"latestReportTime": "0001-01-01T00:00:00Z",
"latestScheduledReportTime": "0001-01-01T00:00:00Z",
"locked": false,
"name": "Case Report",
"nextScheduledTime": "0001-01-01T00:00:00Z",
"orientation": "portrait",
"paperSize": "A4",
"recurrent": false,
"reportType": "investigation",
"runOnce": false,
"scheduled": false,
"sensitive": false,
"startDate": "0001-01-01T00:00:00Z",
"system": false,
"times": 0,
"timezoneOffset": 0,
"type": "pdf",
"tags": [],
"createdBy": "DBot",
"fromVersion": "5.5.0",
"recipients": []
}