{
    "defaultIncidentType": "Cortex XDR Incident",
    "description": "Classifies Cortex XDR incidents.",
    "feed": false,
    "id": "Cortex XDR Incident Handler - Classifier",
    "keyTypeMap": {
        "FirstSSOAccess": "Cortex XDR Incident",
        "Malware": "Malware Investigation and Response",
        "PortScan": "Cortex XDR Incident",
        "RDPBruteForce": "Cortex XDR Incident",
        "XDR Incident": "Cortex XDR Incident"
    },
    "name": "Cortex XDR Incident Handler - Classifier",
    "propagationLabels": [
        "all"
    ],
    "transformer": {
        "complex": {
            "filters": [],
            "root": ".",
            "transformers": [
                {
                    "args": {
                        "dt": {
                            "value": {
                                "simple": ".=val \u0026\u0026 val.description.toLowerCase().indexOf(\"port scan\") \u003e -1 ? \"PortScan\" : (val.description.toLowerCase().indexOf(\"rdp brute-force\") \u003e -1 ? \"RDPBruteForce\" : (val.description.toLowerCase().indexOf(\"first successful sso connection from a country in organization\") \u003e -1 ? \"FirstSSOAccess\" : (val.description.toLowerCase().indexOf(\"first sso access from asn in organization\") \u003e -1 ? \"FirstSSOAccess\" : (!val.file_artifacts || val.file_artifacts.length === 0 ? \"XDR Incident\" : \"Malware\"))))"
                            }
                        }
                    },
                    "operator": "DT"
                }
            ]
        }
    },
    "type": "classification",
    "version": -1,
    "fromVersion": "6.5.0"
}