{
	"id": "Malware",
	"group": "incident",
	"name": "Malware Incident",
	"description": "",
	"version": -1,
	"fromVersion": "6.0.0",
	"detailsV2": {
        "tabs": [
			{
				"id": "summary",
				"name": "Legacy Summary",
				"type": "summary"
			},
			{
				"id": "caseinfoid",
				"name": "Incident Info",
				"sections": [
					{
						"displayType": "ROW",
						"h": 2,
						"i": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8",
						"isVisible": true,
						"items": [
							{
								"endCol": 2,
								"fieldId": "type",
								"height": 24,
								"id": "incident-type-field",
								"index": 0,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "owner",
								"height": 24,
								"id": "incident-owner-field",
								"index": 1,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "sourcebrand",
								"height": 24,
								"id": "incident-sourceBrand-field",
								"index": 2,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "dbotsource",
								"height": 24,
								"id": "incident-source-field",
								"index": 3,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "sourceinstance",
								"height": 24,
								"id": "incident-sourceInstance-field",
								"index": 4,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "playbookid",
								"height": 24,
								"id": "incident-playbookId-field",
								"index": 5,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "severity",
								"height": 24,
								"id": "incident-severity-field",
								"index": 6,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "vendorid",
								"height": 24,
								"id": "3bd5e760-015a-11ea-8100-bba88b41d845",
								"index": 7,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "vendorproduct",
								"height": 24,
								"id": "3d80ff50-015a-11ea-8100-bba88b41d845",
								"index": 8,
								"startCol": 0
							}
						],
						"moved": false,
						"name": "Case Details",
						"static": false,
						"w": 1,
						"x": 0,
						"y": 0
					},
					{
						"h": 2,
						"i": "caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8",
						"moved": false,
						"name": "Notes",
						"static": false,
						"type": "notes",
						"w": 1,
						"x": 1,
						"y": 2
					},
					{
						"displayType": "ROW",
						"h": 2,
						"i": "caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8",
						"moved": false,
						"name": "Work Plan",
						"static": false,
						"type": "workplan",
						"w": 1,
						"x": 2,
						"y": 4
					},
					{
						"displayType": "ROW",
						"h": 2,
						"i": "caseinfoid-770ec200-98b1-11e9-97d7-ed26ef9e46c8",
						"isVisible": true,
						"moved": false,
						"name": "Linked Incidents",
						"static": false,
						"type": "linkedIncidents",
						"w": 1,
						"x": 0,
						"y": 4
					},
					{
						"displayType": "ROW",
						"h": 2,
						"i": "caseinfoid-842632c0-98b1-11e9-97d7-ed26ef9e46c8",
						"moved": false,
						"name": "Child Incidents",
						"static": false,
						"type": "childInv",
						"w": 1,
						"x": 1,
						"y": 4
					},
					{
						"displayType": "ROW",
						"h": 2,
						"hideName": false,
						"i": "caseinfoid-7717e580-9bed-11e9-9a3f-8b4b2158e260",
						"moved": false,
						"name": "Team Members",
						"static": false,
						"type": "team",
						"w": 1,
						"x": 2,
						"y": 2
					},
					{
						"displayType": "CARD",
						"h": 2,
						"i": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
						"items": [
							{
								"dropEffect": "move",
								"endCol": 1,
								"fieldId": "occurred",
								"height": 55,
								"id": "incident-occurred-field",
								"index": 0,
								"listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
								"startCol": 0
							},
							{
								"dropEffect": "move",
								"endCol": 1,
								"fieldId": "dbotmodified",
								"height": 55,
								"id": "incident-modified-field",
								"index": 1,
								"listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
								"startCol": 0
							},
							{
								"dropEffect": "move",
								"endCol": 1,
								"fieldId": "dbotduedate",
								"height": 55,
								"id": "incident-dueDate-field",
								"index": 2,
								"listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
								"startCol": 0
							},
							{
								"dropEffect": "move",
								"endCol": 2,
								"fieldId": "dbotcreated",
								"height": 55,
								"id": "incident-created-field",
								"index": 1,
								"listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289",
								"startCol": 1
							},
							{
								"endCol": 2,
								"fieldId": "dbotclosed",
								"height": 55,
								"id": "incident-closed-field",
								"index": 3,
								"startCol": 1
							}
						],
						"moved": false,
						"name": "Timeline Information",
						"static": false,
						"w": 1,
						"x": 0,
						"y": 2
					},
					{
						"displayType": "ROW",
						"h": 2,
						"i": "caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289",
						"isVisible": true,
						"items": [
							{
								"endCol": 2,
								"fieldId": "dbotclosed",
								"height": 24,
								"id": "incident-dbotClosed-field",
								"index": 0,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "closereason",
								"height": 24,
								"id": "incident-closeReason-field",
								"index": 1,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "closenotes",
								"height": 24,
								"id": "incident-closeNotes-field",
								"index": 2,
								"startCol": 0
							}
						],
						"moved": false,
						"name": "Closing Information",
						"static": false,
						"w": 1,
						"x": 0,
						"y": 6
					},
					{
						"displayType": "ROW",
						"h": 2,
						"hideName": false,
						"i": "caseinfoid-dd0e3db0-f987-11e9-8a28-cd378fee4500",
						"items": [
							{
								"endCol": 2,
								"fieldId": "src",
								"height": 24,
								"id": "0018e210-f988-11e9-8a28-cd378fee4500",
								"index": 0,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "user",
								"height": 24,
								"id": "03bf2dc0-f988-11e9-8a28-cd378fee4500",
								"index": 1,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "hostname",
								"height": 24,
								"id": "077530e0-f988-11e9-8a28-cd378fee4500",
								"index": 2,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "macaddress",
								"height": 24,
								"id": "442ad8f0-0158-11ea-8100-bba88b41d845",
								"index": 3,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "srcntdomain",
								"height": 24,
								"id": "5b3c0780-f988-11e9-8a28-cd378fee4500",
								"index": 4,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "srcos",
								"height": 24,
								"id": "5f4d9820-f988-11e9-8a28-cd378fee4500",
								"index": 5,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "agentid",
								"height": 24,
								"id": "b7ddd220-f992-11e9-8a28-cd378fee4500",
								"index": 6,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "isolated",
								"height": 24,
								"id": "ca971070-f992-11e9-8a28-cd378fee4500",
								"index": 7,
								"startCol": 0
							}
						],
						"maxW": 3,
						"minH": 1,
						"minW": 1,
						"moved": false,
						"name": "Source Details",
						"static": false,
						"w": 1,
						"x": 1,
						"y": 0
					},
					{
						"displayType": "ROW",
						"h": 2,
						"hideName": false,
						"i": "caseinfoid-ed3845a0-f987-11e9-8a28-cd378fee4500",
						"items": [
							{
								"endCol": 2,
								"fieldId": "filename",
								"height": 24,
								"id": "67c39450-f988-11e9-8a28-cd378fee4500",
								"index": 0,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "filepath",
								"height": 24,
								"id": "6a913340-f988-11e9-8a28-cd378fee4500",
								"index": 1,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "filehash",
								"height": 24,
								"id": "77d7ca50-f988-11e9-8a28-cd378fee4500",
								"index": 2,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "md5",
								"height": 24,
								"id": "7dd1a2f0-f988-11e9-8a28-cd378fee4500",
								"index": 3,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "sha1",
								"height": 24,
								"id": "80625ff0-f988-11e9-8a28-cd378fee4500",
								"index": 4,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "sha256",
								"height": 24,
								"id": "88a3dea0-f988-11e9-8a28-cd378fee4500",
								"index": 5,
								"startCol": 0
							},
							{
								"dropEffect": "move",
								"endCol": 2,
								"fieldId": "filesize",
								"height": 24,
								"id": "9afc5f50-f988-11e9-8a28-cd378fee4500",
								"index": 6,
								"listId": "caseinfoid-ed3845a0-f987-11e9-8a28-cd378fee4500",
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "signature",
								"height": 24,
								"id": "cd8dc6c0-f988-11e9-8a28-cd378fee4500",
								"index": 7,
								"startCol": 0
							}
						],
						"maxW": 3,
						"minH": 1,
						"minW": 1,
						"moved": false,
						"name": "File Attributes",
						"static": false,
						"w": 1,
						"x": 2,
						"y": 0
					}
				],
				"type": "custom"
			},
			{
				"hidden": false,
				"id": "myjlgk5lpo",
				"name": "Investigation",
				"sections": [
					{
						"description": "Malicious File details.",
						"displayType": "ROW",
						"h": 2,
						"hideName": false,
						"i": "myjlgk5lpo-cb6e73c0-f989-11e9-8a28-cd378fee4500",
						"items": [
							{
								"endCol": 2,
								"fieldId": "threatactor",
								"height": 24,
								"id": "fd9b9b20-f989-11e9-8a28-cd378fee4500",
								"index": 0,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "maliciousbehavior",
								"height": 24,
								"id": "1468db10-f98a-11e9-8a28-cd378fee4500",
								"index": 1,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "malwarefamily",
								"height": 24,
								"id": "ea06f0f0-f989-11e9-8a28-cd378fee4500",
								"index": 2,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "commandline",
								"height": 24,
								"id": "cfad8790-f98a-11e9-8a28-cd378fee4500",
								"index": 5,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "quarantined",
								"height": 24,
								"id": "e6f02920-f98b-11e9-8a28-cd378fee4500",
								"index": 6,
								"startCol": 0
							},
							{
								"endCol": 2,
								"fieldId": "terminatedaction",
								"height": 24,
								"id": "fbb19380-f98b-11e9-8a28-cd378fee4500",
								"index": 7,
								"startCol": 0
							},
							{
								"dropEffect": "move",
								"endCol": 2,
								"fieldId": "blockedaction",
								"height": 24,
								"id": "f6669880-f98b-11e9-8a28-cd378fee4500",
								"index": 8,
								"listId": "myjlgk5lpo-cb6e73c0-f989-11e9-8a28-cd378fee4500",
								"startCol": 0
							}
						],
						"maxW": 3,
						"minH": 1,
						"minW": 1,
						"moved": false,
						"name": "Malware Details",
						"static": false,
						"w": 1,
						"x": 0,
						"y": 0
					},
					{
						"h": 2,
						"hideName": false,
						"i": "myjlgk5lpo-396defe0-f98a-11e9-8a28-cd378fee4500",
						"items": [],
						"maxW": 3,
						"minH": 1,
						"minW": 1,
						"moved": false,
						"name": "Indicators",
						"query": "",
						"queryType": "input",
						"static": false,
						"type": "indicators",
						"w": 3,
						"x": 0,
						"y": 4
					},
					{
						"description": "Related malicious files that are found during the investigation.",
						"h": 2,
						"hideName": false,
						"i": "myjlgk5lpo-8bd42510-f98a-11e9-8a28-cd378fee4500",
						"items": [],
						"maxW": 3,
						"minH": 1,
						"minW": 1,
						"moved": false,
						"name": "Incident Files",
						"query": {
							"categories": [
								"attachments"
							],
							"lastId": "",
							"pageSize": 100,
							"tags": [],
							"users": []
						},
						"queryType": "warRoomFilter",
						"static": false,
						"type": "invTimeline",
						"w": 1,
						"x": 2,
						"y": 2
					},
					{
						"description": "CVEs used by the malware.",
						"displayType": "ROW",
						"h": 2,
						"hideName": false,
						"i": "myjlgk5lpo-924eed80-f98a-11e9-8a28-cd378fee4500",
						"items": [
							{
								"endCol": 2,
								"fieldId": "cve",
								"height": 24,
								"id": "ae34cdd0-f98a-11e9-8a28-cd378fee4500",
								"index": 0,
								"startCol": 0
							},
							{
								"dropEffect": "move",
								"endCol": 4,
								"fieldId": "cvss",
								"height": 24,
								"id": "b9b87f30-f98a-11e9-8a28-cd378fee4500",
								"index": 0,
								"listId": "myjlgk5lpo-924eed80-f98a-11e9-8a28-cd378fee4500",
								"startCol": 2
							}
						],
						"maxW": 3,
						"minH": 1,
						"minW": 1,
						"moved": false,
						"name": "Used CVEs",
						"static": false,
						"w": 2,
						"x": 0,
						"y": 2
					},
					{
						"description": "Infected endpoints found during the investigation.",
						"displayType": "ROW",
						"h": 2,
						"hideName": false,
						"i": "myjlgk5lpo-de1a0100-f98a-11e9-8a28-cd378fee4500",
						"items": [
							{
								"endCol": 4,
								"fieldId": "infectedhosts",
								"height": 110,
								"id": "fb324d30-f992-11e9-8a28-cd378fee4500",
								"index": 0,
								"startCol": 0
							}
						],
						"maxW": 3,
						"minH": 1,
						"minW": 1,
						"moved": false,
						"name": "Infected Enpoints",
						"static": false,
						"w": 2,
						"x": 1,
						"y": 0
					},
					{
						"description": "Attachments that are relevant for the investigation, such as sandbox reports, suspicious artifacts, etc.",
						"displayType": "CARD",
						"h": 2,
						"hideItemTitleOnlyOne": true,
						"hideName": false,
						"i": "myjlgk5lpo-224c8000-f98b-11e9-8a28-cd378fee4500",
						"items": [
							{
								"endCol": 2,
								"fieldId": "incident_attachment",
								"height": 55,
								"id": "224490c1-f98b-11e9-8a28-cd378fee4500",
								"index": 0,
								"isVisible": true,
								"startCol": 0
							}
						],
						"maxW": 3,
						"minH": 1,
						"minW": 1,
						"moved": false,
						"name": "Attachments",
						"static": false,
						"type": "",
						"w": 1,
						"x": 0,
						"y": 6
					}
				],
				"type": "custom"
			},
			{
				"id": "warRoom",
				"name": "War Room",
				"type": "warRoom"
			},
			{
				"id": "workPlan",
				"name": "Work Plan",
				"type": "workPlan"
			},
			{
				"id": "evidenceBoard",
				"name": "Evidence Board",
				"type": "evidenceBoard"
			},
			{
				"id": "relatedIncidents",
				"name": "Related Incidents",
				"type": "relatedIncidents"
			},
			{
				"id": "canvas",
				"name": "Canvas",
				"type": "canvas"
			}
		]
    },
    "edit": {
        "sections": [
			{
				"id": "",
				"version": 0,
				"modified": "0001-01-01T00:00:00Z",
				"name": "Basic Information",
				"type": "",
				"isVisible": true,
				"readOnly": false,
				"fields": [
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_name",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_occurred",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_reminder",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_owner",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_roles",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_type",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_severity",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_playbookid",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_labels",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_phase",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_details",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_attachment",
						"isVisible": true
					}
				],
				"description": "",
				"query": null,
				"queryType": ""
			},
			{
				"id": "",
				"version": 0,
				"modified": "0001-01-01T00:00:00Z",
				"name": "Malware File",
				"type": "",
				"isVisible": true,
				"readOnly": false,
				"fields": [
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_filename",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_filepath",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_filehash",
						"isVisible": true
					}
				],
				"description": "",
				"query": null,
				"queryType": ""
			},
			{
				"id": "",
				"version": 0,
				"modified": "0001-01-01T00:00:00Z",
				"name": "Malware Info",
				"type": "",
				"isVisible": true,
				"readOnly": false,
				"fields": [
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_signature",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_malwarefamily",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_src",
						"isVisible": true
					}
				],
				"description": "",
				"query": null,
				"queryType": ""
			},
			{
				"id": "",
				"version": 0,
				"modified": "0001-01-01T00:00:00Z",
				"name": "System Affected",
				"type": "",
				"isVisible": true,
				"readOnly": false,
				"fields": [
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_vendorproduct",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_dest",
						"isVisible": true
					},
					{
						"id": "",
						"version": 0,
						"modified": "0001-01-01T00:00:00Z",
						"fieldId": "incident_destntdomain",
						"isVisible": true
					}
				],
				"description": "",
				"query": null,
				"queryType": ""
			},
			{
				"id": "",
				"version": 0,
				"modified": "0001-01-01T00:00:00Z",
				"name": "Custom Fields",
				"type": "",
				"isVisible": true,
				"readOnly": false,
				"fields": [],
				"description": "",
				"query": null,
				"queryType": ""
			}
		]
    },
 "marketplaces": ["xsoar"]
}