{
    "id": "IronDefense Event Notification",
    "group": "incident",
    "name": "IronDefense Event Notification",
    "description": "IronDefense Event Notification Layout",
    "version": -1,
    "fromVersion": "6.0.0",
    "detailsV2": {
        "sections": [
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "IronDefense Details",
                "type": "",
                "isVisible": true,
                "readOnly": false,
                "fields": [
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensealertid",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenseeventid",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensecategory",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensesubcategory",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenseseverity",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenseconfidence",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenseprimaryappprotocol",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensesecondaryappprotocol",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenseappdomins",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensebytesin",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensebytesout",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensetotalbytes",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensesrcip",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensedstip",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensedstport",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensesrcentityattribute",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensesrcentityattributetype",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensedstentityattribute",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensesrcnetworkid",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensedstnetworkid",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensedomesharedtime",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensestarttime",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenseendtime",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenseisblacklisted",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenseiswhitelisted",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefenserawdataformat",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_irondefensevueurl",
                        "isVisible": true
                    }
                ],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Basic Information",
                "type": "",
                "isVisible": true,
                "readOnly": false,
                "fields": [
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_type",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_severity",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_owner",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_dbotstatus",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_sourcebrand",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_sourceinstance",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_playbookid",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_phase",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_roles",
                        "isVisible": true
                    }
                ],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Work Plan",
                "type": "workplan",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Timeline Information",
                "type": "",
                "isVisible": true,
                "readOnly": false,
                "fields": [
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_dbotcreated",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_occurred",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_dbotduedate",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_dbotmodified",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_dbottotaltime",
                        "isVisible": true
                    }
                ],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Custom Fields",
                "type": "",
                "isVisible": true,
                "readOnly": false,
                "fields": [
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_detectionsla",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_remediationsla",
                        "isVisible": true
                    },
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_timetoassignment",
                        "isVisible": true
                    }
                ],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Details",
                "type": "",
                "isVisible": true,
                "readOnly": true,
                "fields": [
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_details",
                        "isVisible": true
                    }
                ],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Labels",
                "type": "labels",
                "isVisible": true,
                "readOnly": true,
                "fields": [
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_labels",
                        "isVisible": true
                    }
                ],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Attachments",
                "type": "",
                "isVisible": true,
                "readOnly": true,
                "fields": [
                    {
                        "id": "",
                        "version": 0,
                        "modified": "0001-01-01T00:00:00Z",
                        "fieldId": "incident_attachment",
                        "isVisible": true
                    }
                ],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Bad or Suspicious Indicators",
                "type": "indicators",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": "reputation:Bad or reputation:Suspicious",
                "queryType": "input"
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Evidence",
                "type": "evidence",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Notes",
                "type": "notes",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Dropped Duplicate Incidents",
                "type": "droppedIncidents",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Linked Incidents",
                "type": "linkedIncidents",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Incident Timeline",
                "type": "invTimeline",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": {
                    "categories": [
                        "incidentInfo"
                    ],
                    "lastId": "",
                    "pageSize": 100,
                    "tags": [],
                    "users": []
                },
                "queryType": "warRoomFilter"
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "General Purpose Dynamic Section",
                "type": "dynamic",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": "script"
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Incident Files",
                "type": "invTimeline",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": {
                    "categories": [
                        "attachments"
                    ],
                    "lastId": "",
                    "pageSize": 100,
                    "tags": [],
                    "users": []
                },
                "queryType": "warRoomFilter"
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Team",
                "type": "team",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Child Incidents",
                "type": "childInv",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": ""
            },
            {
                "id": "",
                "version": 0,
                "modified": "0001-01-01T00:00:00Z",
                "name": "Automation Highlights",
                "type": "findings",
                "isVisible": true,
                "readOnly": true,
                "fields": [],
                "description": "",
                "query": null,
                "queryType": ""
            }
        ]
    }
}