{ "detailsV2": { "tabs": [ { "id": "summary", "name": "Legacy Summary", "type": "summary" }, { "id": "w68olunplf", "name": "Alert Overview", "sections": [ { "displayType": "ROW", "h": 4, "i": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "isVisible": true, "items": [ { "dropEffect": "move", "endCol": 2, "fieldId": "details", "height": 52, "id": "454bde00-98d5-11ee-a5aa-39f0d8c6d1cc", "index": 0, "listId": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "timestamp", "height": 26, "id": "ca3282e0-ac81-11ed-90e1-81bc84c0d1fb", "index": 1, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "type", "height": 26, "id": "incident-type-field", "index": 3, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "playbookid", "height": 26, "id": "incident-playbookId-field", "index": 4, "listId": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "severity", "height": 26, "id": "incident-severity-field", "index": 5, "listId": "3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "sourcebrand", "height": 26, "id": "incident-sourceBrand-field", "index": 6, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "tags", "height": 26, "id": "10f0cfa0-9810-11ee-99ee-4be4f8dc69b3", "index": 7, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "sourceip", "height": 26, "id": "c28fb940-2762-11ec-9959-2922ebe0f011", "index": 8, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "mitreattcktactic", "height": 26, "id": "6bd5e520-98d5-11ee-a5aa-39f0d8c6d1cc", "index": 9, "listId": "w68olunplf-3podiwrjhh-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "mitreattcktechnique", "height": 26, "id": "769a1710-98d5-11ee-a5aa-39f0d8c6d1cc", "index": 10, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Alert Details", "static": false, "w": 1, "x": 0, "y": 0 }, { "displayType": "ROW", "h": 4, "i": "w68olunplf-3podiwrjhh-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8", "maxW": 3, "minH": 1, "moved": false, "name": "Work Plan", "static": false, "type": "workplan", "w": 1, "x": 1, "y": 0 }, { "displayType": "ROW", "h": 3, "i": "w68olunplf-3podiwrjhh-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289", "isVisible": true, "items": [ { "endCol": 2, "fieldId": "dbotclosed", "height": 26, "id": "incident-dbotClosed-field", "index": 0, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "closereason", "height": 26, "id": "incident-closeReason-field", "index": 1, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "closenotes", "height": 52, "id": "incident-closeNotes-field", "index": 2, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Closing Information", "static": false, "w": 1, "x": 1, "y": 4 }, { "displayType": "ROW", "h": 2, "hideName": false, "i": "w68olunplf-3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07", "items": [ { "args": { "using-brand": { "simple": "", "userMarkedRequired": true } }, "buttonClass": "secondary", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "cd789af0-b057-11ed-95eb-6fbf73c92c07", "index": 0, "listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07", "name": "Enrich indicators", "scriptId": "Builtin|||enrichIndicators", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "secondary", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "199cd250-b055-11ed-95eb-6fbf73c92c07", "index": 1, "listId": "3podiwrjhh-5b7abf80-b040-11ed-95eb-6fbf73c92c07", "name": "Tag Indicators", "scriptId": "AppendindicatorFieldWrapper", "sectionItemType": "button", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Indicators Handling", "static": false, "w": 1, "x": 2, "y": 5 }, { "displayType": "ROW", "h": 2, "hideName": false, "i": "w68olunplf-3podiwrjhh-c0edb6d0-b1d8-11ed-922b-b50d0a485e48", "items": [ { "args": {}, "buttonClass": "secondary", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "5231c120-b1db-11ed-922b-b50d0a485e48", "index": 0, "name": "IP Prevalence", "scriptId": "Cortex Core - IR|||core-get-IP-analytics-prevalence", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "secondary", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "57db2fd0-b1db-11ed-922b-b50d0a485e48", "index": 1, "name": "User Prevalence", "scriptId": "DisableUserWrapper", "sectionItemType": "button", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Analytics Prevalence Check", "static": false, "w": 1, "x": 2, "y": 3 }, { "displayType": "ROW", "h": 3, "hideName": false, "i": "w68olunplf-3podiwrjhh-68821790-b77b-11ed-a817-f75b1612b8eb", "items": [ { "endCol": 2, "fieldId": "username", "height": 26, "id": "88fe9700-b77b-11ed-a817-f75b1612b8eb", "index": 0, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "samaccountname", "height": 26, "id": "30c1b470-98ce-11ee-8aac-c7473a83f305", "index": 1, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "accountstatus", "height": 26, "id": "38a50d90-98ce-11ee-8aac-c7473a83f305", "index": 2, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "email", "height": 26, "id": "4d3ebd00-9810-11ee-99ee-4be4f8dc69b3", "index": 3, "listId": "w68olunplf-3podiwrjhh-68821790-b77b-11ed-a817-f75b1612b8eb", "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "accountmemberof", "height": 26, "id": "06c05890-9818-11ee-99ee-4be4f8dc69b3", "index": 4, "listId": "w68olunplf-3podiwrjhh-68821790-b77b-11ed-a817-f75b1612b8eb", "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "cloudaccountid", "height": 26, "id": "593a3cd0-9818-11ee-99ee-4be4f8dc69b3", "index": 5, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "accountid", "height": 26, "id": "d6fc9860-98cd-11ee-8aac-c7473a83f305", "index": 6, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "manageremailaddress", "height": 26, "id": "2ef1f0f0-98e3-11ee-a5aa-39f0d8c6d1cc", "index": 7, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Identity Details", "static": false, "w": 1, "x": 0, "y": 4 }, { "displayType": "ROW", "h": 3, "hideName": false, "i": "w68olunplf-a0a75d10-98cb-11ee-8aac-c7473a83f305", "items": [ { "args": {}, "buttonClass": "error", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "58c9e200-98cc-11ee-8aac-c7473a83f305", "index": 0, "name": "Clear User's Sessions - Okta ", "scriptId": "Okta v2|||okta-clear-user-sessions", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "error", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "5ed87b20-98cc-11ee-8aac-c7473a83f305", "index": 1, "listId": "w68olunplf-a0a75d10-98cb-11ee-8aac-c7473a83f305", "name": "Revoke User's Sessions - Azure", "scriptId": "Microsoft Graph User|||msgraph-user-session-revoke", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "error", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "af5e7ea0-98cc-11ee-8aac-c7473a83f305", "index": 2, "listId": "w68olunplf-a0a75d10-98cb-11ee-8aac-c7473a83f305", "name": "Reset Password - Active Directory", "scriptId": "Active Directory Query v2|||ad-set-new-password", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "error", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "af5e7ea0-98cc-11ee-8aac-c7473a83f305", "index": 3, "listId": "w68olunplf-a0a75d10-98cb-11ee-8aac-c7473a83f305", "name": "Disable Account", "scriptId": "DisableUserWrapper", "sectionItemType": "button", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Response Actions", "static": false, "w": 1, "x": 2, "y": 0 } ], "showEmptyFields": true, "type": "custom" }, { "hidden": false, "id": "xxtngoiqpq", "name": "Technical Information", "sections": [ { "h": 8, "i": "w68olunplf-3podiwrjhh-bc5306a0-9fdd-11ed-882b-b559788954b9", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Mapped Fields", "query": "displayMappedFields", "queryType": "script", "static": false, "type": "dynamic", "w": 1, "x": 2, "y": 0 }, { "description": "Additional Found alerts by Mitre tactics related to the user.", "displayType": "ROW", "h": 3, "hideName": false, "i": "w68olunplf-86548370-9808-11ee-b83f-43a8d6b51fe8", "items": [ { "dropEffect": "move", "endCol": 6, "fieldId": "alertsearchresults", "height": 106, "id": "924379c0-9808-11ee-b83f-43a8d6b51fe8", "index": 0, "listId": "w68olunplf-86548370-9808-11ee-b83f-43a8d6b51fe8", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Found Related Alerts", "static": false, "w": 2, "x": 0, "y": 2 }, { "displayType": "CARD", "h": 2, "hideName": false, "i": "w68olunplf-9915bec0-980d-11ee-99ee-4be4f8dc69b3", "items": [ { "endCol": 2, "fieldId": "numberoffoundrelatedalerts", "height": 53, "id": "ca488090-980d-11ee-99ee-4be4f8dc69b3", "index": 0, "sectionItemType": "field", "startCol": 0 }, { "endCol": 2, "fieldId": "failedlogonevents", "height": 53, "id": "e8499fc0-980d-11ee-99ee-4be4f8dc69b3", "index": 1, "sectionItemType": "field", "startCol": 0 }, { "dropEffect": "move", "endCol": 2, "fieldId": "userrisklevel", "height": 53, "id": "dcabafa0-980d-11ee-99ee-4be4f8dc69b3", "index": 2, "listId": "w68olunplf-9915bec0-980d-11ee-99ee-4be4f8dc69b3", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Investigation Results", "static": false, "w": 1, "x": 1, "y": 0 }, { "h": 2, "i": "w68olunplf-05a38270-980e-11ee-99ee-4be4f8dc69b3", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Investigation Verdict", "query": "VerdictResult", "queryType": "script", "static": false, "type": "dynamic", "w": 1, "x": 0, "y": 0 }, { "h": 3, "i": "w68olunplf-6ee6cfe0-982b-11ee-9d69-eb396ec63adf", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Malicious or Suspicious Indicators", "query": "reputation:Bad or reputation:Suspicious", "queryType": "input", "static": false, "type": "indicators", "w": 2, "x": 0, "y": 5 } ], "showEmptyFields": true, "type": "custom" }, { "hidden": false, "id": "ne8rnxp0ye", "name": "Investigation Tools", "sections": [ { "displayType": "ROW", "h": 2, "hideName": false, "i": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108", "items": [ { "args": { "input": { "simple": "", "userMarkedRequired": true }, "output_key": { "simple": "fileOutputExtension" } }, "buttonClass": "secondary", "dropEffect": "move", "endCol": 1, "fieldId": "", "height": 44, "hexColor": null, "id": "d2b5eb10-9a42-11ed-aff5-5d4496197108", "index": 0, "listId": "caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108", "name": "Set the output extension", "scriptId": "ChangeContext", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "secondary", "endCol": 1, "fieldId": "", "height": 44, "hexColor": null, "id": "3d025e80-9b39-11ed-860b-4d504a46d33a", "index": 1, "name": "XML to JSON", "scriptId": "ConvertXmlToJson", "sectionItemType": "button", "startCol": 0 }, { "args": { "format": { "complex": { "accessor": "", "filters": [], "root": "fileOutputExtension", "transformers": [] }, "userMarkedRequired": true } }, "buttonClass": "secondary", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "7a924a00-9a42-11ed-aff5-5d4496197108", "index": 0, "listId": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108", "name": "Convert the file", "scriptId": "ConvertFile", "sectionItemType": "button", "startCol": 1 }, { "args": {}, "buttonClass": "secondary", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "508f4080-9b39-11ed-860b-4d504a46d33a", "index": 2, "listId": "3podiwrjhh-caseinfoid-3429b120-9a42-11ed-aff5-5d4496197108", "name": "JSON to CSV", "scriptId": "JSONtoCSV", "sectionItemType": "button", "startCol": 1 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Data Formats", "static": false, "w": 1, "x": 0, "y": 0 }, { "displayType": "ROW", "h": 1, "hideName": false, "i": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108", "items": [ { "args": {}, "buttonClass": "secondary", "dropEffect": "move", "endCol": 1, "fieldId": "", "height": 44, "hexColor": null, "id": "35b03f30-9a44-11ed-aff5-5d4496197108", "index": 0, "listId": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108", "name": "Base64 decode", "scriptId": "Base64Decode", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "secondary", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "5cac9020-9a44-11ed-aff5-5d4496197108", "index": 1, "listId": "3podiwrjhh-caseinfoid-4de9e060-9a44-11ed-aff5-5d4496197108", "name": "Base64 encode", "scriptId": "Base64EncodeV2", "sectionItemType": "button", "startCol": 1 } ], "maxW": 3, "minH": 1, "moved": false, "name": "En/Decoding", "static": false, "w": 1, "x": 0, "y": 4 }, { "description": "", "displayType": "ROW", "h": 1, "hideName": false, "i": "3podiwrjhh-63d041e0-9b38-11ed-860b-4d504a46d33a", "items": [ { "args": {}, "buttonClass": "secondary", "dropEffect": "move", "endCol": 1, "fieldId": "", "height": 44, "hexColor": null, "id": "ca3777a0-9b38-11ed-860b-4d504a46d33a", "index": 0, "listId": "3podiwrjhh-63d041e0-9b38-11ed-860b-4d504a46d33a", "name": "Calculate entropy", "scriptId": "CalculateEntropy", "sectionItemType": "button", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "File Analysis", "static": false, "w": 1, "x": 0, "y": 5 }, { "displayType": "ROW", "h": 2, "hideName": false, "i": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a", "items": [ { "args": { "server": { "simple": "", "userMarkedRequired": true } }, "buttonClass": "secondary", "dropEffect": "move", "endCol": 1, "fieldId": "", "height": 44, "hexColor": null, "id": "5cbebc90-a16b-11ed-9ca2-fbb17e2c305f", "index": 0, "listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a", "name": "Dig", "scriptId": "Dig", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "secondary", "dropEffect": "move", "endCol": 1, "fieldId": "", "height": 44, "hexColor": null, "id": "f2142100-9b39-11ed-860b-4d504a46d33a", "index": 1, "listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a", "name": "Reverse IP lookup to host", "scriptId": "IPToHost", "sectionItemType": "button", "startCol": 0 }, { "args": {}, "buttonClass": "secondary", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "60256ce0-9b39-11ed-860b-4d504a46d33a", "index": 0, "listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a", "name": "Check if IP address is in CIDR", "scriptId": "IsInCidrRanges", "sectionItemType": "button", "startCol": 1 }, { "args": {}, "buttonClass": "secondary", "dropEffect": "move", "endCol": 2, "fieldId": "", "height": 44, "hexColor": null, "id": "1f664d40-9b3a-11ed-860b-4d504a46d33a", "index": 2, "listId": "3podiwrjhh-dc4da2b0-9b39-11ed-860b-4d504a46d33a", "name": "Expand Shortened URL", "scriptId": "ResolveShortenedURL", "sectionItemType": "button", "startCol": 1 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Network Utils", "static": false, "w": 1, "wrapLabels": false, "x": 0, "y": 2 }, { "description": "When you click a button in this tab - the execution results will be displayed here.\nTo clear this table click \u201cclear results\u201c.", "h": 8, "i": "3podiwrjhh-796c1f40-a6d4-11ed-8f16-61aeed0987f5", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Results", "query": "displayUtilitiesResults", "queryType": "script", "static": false, "type": "dynamic", "w": 2, "x": 1, "y": 0 }, { "description": "Clear the results table", "displayType": "ROW", "h": 2, "hideName": false, "i": "3podiwrjhh-2fabcc30-b1d2-11ed-9b75-f5e3e7c3244c", "items": [ { "args": { "all": { "simple": "no" }, "key": { "complex": { "accessor": "id", "filters": [], "root": "alert", "transformers": [ { "args": { "limit": { "isContext": false }, "replaceWith": { "isContext": false, "value": { "simple": "Base64,digresults,EntropyResult,ResolveShortenedURL,Endpoint" } }, "toReplace": { "isContext": true, "value": { "simple": "alert.id" } } }, "operator": "replace" }, { "args": { "delimiter": { "isContext": false, "value": { "simple": "," } } }, "operator": "split" } ] } } }, "buttonClass": "CLEAR", "dropEffect": "move", "endCol": 4, "fieldId": "", "height": 44, "hexColor": null, "id": "40ca1f30-b1d2-11ed-9b75-f5e3e7c3244c", "index": 0, "listId": "3podiwrjhh-2fabcc30-b1d2-11ed-9b75-f5e3e7c3244c", "name": "Clear Results", "scriptId": "DeleteContext", "sectionItemType": "button", "startCol": 2 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Clear Results", "static": false, "w": 1, "x": 0, "y": 6 } ], "type": "custom" }, { "id": "warRoom", "name": "War Room", "type": "warRoom" }, { "id": "workPlan", "name": "Work Plan", "type": "workPlan" }, { "id": "canvas", "name": "Canvas", "type": "canvas", "hidden": false } ] }, "group": "incident", "id": "Identity Analytics Alerts", "name": "Identity Analytics Alerts", "quickView": { "sections": [ { "description": "", "fields": [ { "fieldId": "incident_type", "isVisible": true }, { "fieldId": "incident_severity", "isVisible": true }, { "fieldId": "incident_owner", "isVisible": true }, { "fieldId": "incident_dbotstatus", "isVisible": true }, { "fieldId": "incident_sourcebrand", "isVisible": true }, { "fieldId": "incident_sourceinstance", "isVisible": true }, { "fieldId": "incident_playbookid", "isVisible": true }, { "fieldId": "incident_phase", "isVisible": true }, { "fieldId": "incident_roles", "isVisible": true } ], "isVisible": true, "name": "Basic Information", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_dbotcreated", "isVisible": true }, { "fieldId": "incident_occurred", "isVisible": true }, { "fieldId": "incident_dbotduedate", "isVisible": true }, { "fieldId": "incident_dbotmodified", "isVisible": true }, { "fieldId": "incident_dbottotaltime", "isVisible": true } ], "isVisible": true, "name": "Timeline Information", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_phonenumber", "isVisible": true } ], "isVisible": true, "name": "Custom Fields", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "fields": [ { "fieldId": "incident_labels", "isVisible": true } ], "isVisible": true, "name": "Labels", "query": null, "queryType": "", "readOnly": true, "type": "labels" } ] }, "system": false, "version": -1, "fromVersion": "6.10.0", "description": "" }