{ "detailsV2": { "tabs": [ { "id": "summary", "name": "Legacy Summary", "type": "summary" }, { "id": "caseinfoid", "name": "Incident Info", "sections": [ { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 }, { "displayed": true, "isDefault": true, "key": "score", "width": 120 }, { "displayed": true, "isDefault": true, "key": "firstSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "lastSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "timestamp", "width": 190 }, { "displayed": true, "isDefault": true, "key": "relatedIncCount", "width": 150 }, { "displayed": true, "isDefault": true, "key": "sourceBrands", "width": 175 }, { "displayed": true, "isDefault": true, "key": "sourceInstances", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expirationStatus", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expiration", "width": 190 } ], "displayType": "ROW", "h": 3, "i": "caseinfoid-field-changed-caseinfoid-7ce69dd0-a07f-11e9-936c-5395a1acf11e", "maxW": 3, "minH": 1, "moved": false, "name": "IP Indicators", "query": "type:IP", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 1, "y": 6 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 }, { "displayed": true, "isDefault": true, "key": "score", "width": 120 }, { "displayed": true, "isDefault": true, "key": "firstSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "lastSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "timestamp", "width": 190 }, { "displayed": true, "isDefault": true, "key": "relatedIncCount", "width": 150 }, { "displayed": true, "isDefault": true, "key": "sourceBrands", "width": 175 }, { "displayed": true, "isDefault": true, "key": "sourceInstances", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expirationStatus", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expiration", "width": 190 } ], "h": 2, "i": "caseinfoid-field-changed-caseinfoid-38c534a0-0cdc-11ed-89d1-e5ac65360f00", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Domain Indicators", "query": "type:Domain", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 1, "y": 0 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 }, { "displayed": true, "isDefault": true, "key": "score", "width": 120 }, { "displayed": true, "isDefault": true, "key": "firstSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "lastSeen", "width": 275 }, { "displayed": true, "isDefault": true, "key": "timestamp", "width": 190 }, { "displayed": true, "isDefault": true, "key": "relatedIncCount", "width": 150 }, { "displayed": true, "isDefault": true, "key": "sourceBrands", "width": 175 }, { "displayed": true, "isDefault": true, "key": "sourceInstances", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expirationStatus", "width": 175 }, { "displayed": true, "isDefault": true, "key": "expiration", "width": 190 } ], "h": 2, "i": "caseinfoid-field-changed-caseinfoid-42633610-0cdc-11ed-89d1-e5ac65360f00", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "URL Indicators", "query": "type:URL", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 1, "y": 2 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 } ], "h": 2, "i": "caseinfoid-field-changed-caseinfoid-06e49f40-0cdf-11ed-89d1-e5ac65360f00", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Windows Path Indicators", "query": "type:\"Windows File Path\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 0, "y": 2 }, { "description": "", "h": 2, "i": "caseinfoid-8c0f6750-0d83-11ed-9e08-b96f717afa75", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Indicators Type", "query": "Indicators-type", "queryType": "script", "static": false, "type": "dynamic", "w": 1, "x": 0, "y": 0 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 } ], "h": 3, "i": "caseinfoid-8e64f340-0d87-11ed-a87d-ffc9245ec67b", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Date and Time Indicators", "query": "type:\"Windows Date and Time\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 0, "y": 6 }, { "columns": [ { "displayed": true, "isDefault": true, "key": "value", "width": 300 } ], "description": "", "h": 2, "i": "caseinfoid-99427990-0d87-11ed-a87d-ffc9245ec67b", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Executables Indicators", "query": "type:\"Windows Executables\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 0, "y": 4 }, { "h": 2, "i": "caseinfoid-4cf90f60-119a-11ed-bd36-d1bd96220a2e", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Overall Strings Score", "query": "SetRDPOverallScore", "queryType": "script", "static": false, "type": "dynamic", "w": 1, "x": 2, "y": 0 }, { "h": 2, "i": "caseinfoid-87b6fcf0-1255-11ed-bd36-d1bd96220a2e", "items": [], "maxW": 3, "minH": 1, "moved": false, "name": "Email Address Indicators", "query": "type:\"email\"", "queryType": "input", "static": false, "type": "indicators", "w": 1, "x": 1, "y": 4 }, { "displayType": "ROW", "h": 3, "hideItemTitleOnlyOne": true, "hideName": false, "i": "caseinfoid-e8540fc1-1426-11ee-a737-19f59cf74e83", "items": [ { "dropEffect": "move", "endCol": 2, "fieldId": "incidentrdpachehuntingstringssimilarity", "height": 106, "id": "479f2bb0-1ac4-11ee-874e-530925bceb83", "index": 0, "listId": "caseinfoid-e8540fc1-1426-11ee-a737-19f59cf74e83", "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Strings Similarity", "static": false, "w": 1, "x": 2, "y": 2 }, { "displayType": "ROW", "h": 4, "hideItemTitleOnlyOne": true, "hideName": false, "i": "caseinfoid-f42767c1-1426-11ee-a737-19f59cf74e83", "items": [ { "endCol": 2, "fieldId": "incidentrdpcachehuntingstringsifter", "height": 106, "id": "4c314340-18dd-11ee-8250-4d18bfc11034", "index": 1, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "String Sifter", "static": false, "w": 1, "x": 2, "y": 5 } ], "type": "custom" }, { "hidden": false, "id": "zeizgsgise", "name": "RDP Image", "sections": [ { "h": 5, "i": "caseinfoid-zeizgsgise-caseinfoid-f93d1ae0-df81-11ed-a0c9-ff82a3e1ffaf", "items": [], "maxH": null, "maxW": 3, "minH": 1, "moved": false, "name": "War Room Entries", "query": { "tags": [ "RDPCacheImage" ] }, "queryType": "warRoomFilter", "static": false, "type": "invTimeline", "w": 3, "x": 0, "y": 0 } ], "type": "custom" }, { "id": "evidenceBoard", "name": "Evidence Board", "type": "evidenceBoard" }, { "hidden": false, "id": "ozhko2yuki", "name": "Technical Details", "sections": [ { "displayType": "ROW", "h": 7, "hideItemTitleOnlyOne": true, "hideName": true, "i": "caseinfoid-26052c30-1245-11ed-bd36-d1bd96220a2e", "items": [ { "endCol": 6, "fieldId": "usecasedescription", "height": 44, "id": "2826fac0-1245-11ed-bd36-d1bd96220a2e", "index": 0, "sectionItemType": "field", "startCol": 0 } ], "maxW": 3, "minH": 1, "moved": false, "name": "Use Case Description", "static": false, "w": 3, "x": 0, "y": 0 } ], "type": "custom" }, { "id": "warRoom", "name": "War Room", "type": "warRoom" }, { "id": "workPlan", "name": "Work Plan", "type": "workPlan" }, { "id": "relatedIncidents", "name": "Related Incidents", "type": "relatedIncidents" }, { "id": "canvas", "name": "Canvas", "type": "canvas" } ] }, "edit": { "sections": [ { "description": "", "fields": [ { "fieldId": "incident_name", "isVisible": true }, { "fieldId": "incident_occurred", "isVisible": true }, { "fieldId": "incident_reminder", "isVisible": true }, { "fieldId": "incident_owner", "isVisible": true }, { "fieldId": "incident_roles", "isVisible": true }, { "fieldId": "incident_type", "isVisible": true }, { "fieldId": "incident_severity", "isVisible": true }, { "fieldId": "incident_playbookid", "isVisible": true }, { "fieldId": "incident_labels", "isVisible": true }, { "fieldId": "incident_phase", "isVisible": true }, { "fieldId": "incident_details", "isVisible": true }, { "fieldId": "incident_attachment", "isVisible": true } ], "isVisible": true, "name": "Basic Information", "query": null, "queryType": "", "readOnly": false, "type": "" }, { "description": "", "isVisible": true, "name": "Custom Fields", "query": null, "queryType": "", "readOnly": false, "type": "" } ] }, "group": "incident", "id": "RDP Sessions", "name": "RDP Sessions", "system": false, "version": -1, "fromVersion": "6.9.0", "description": "" }