id: IP Enrichment - Internal - Generic v2 version: -1 name: IP Enrichment - Internal - Generic v2 description: |- Enrich Internal IP addresses using one or more integrations. - Resolve IP address to hostname (DNS) - Separate internal and external IP addresses - Get host information for IP addresses. starttaskid: "0" tasks: "0": id: "0" taskid: 6635b28b-bdf1-42cf-88bc-14ad75e9ebe0 type: start task: id: 6635b28b-bdf1-42cf-88bc-14ad75e9ebe0 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "28" separatecontext: false view: |- { "position": { "x": 170, "y": 199 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 8149db7c-af8d-41e2-85ee-c9fe2efd5040 type: title task: id: 8149db7c-af8d-41e2-85ee-c9fe2efd5040 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 1010, "y": 1770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: a22c2045-33e0-4ad3-8627-15886227f805 type: title task: id: a22c2045-33e0-4ad3-8627-15886227f805 version: -1 name: Enrich internal IP addresses type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" separatecontext: false view: |- { "position": { "x": 170, "y": 1430 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: cd79c4ac-4dec-4872-8ec8-35079ffe9e5d type: condition task: id: cd79c4ac-4dec-4872-8ec8-35079ffe9e5d version: -1 name: Are the IPs already classified? description: Checks whether the playbook's input contains at least one IP address. type: condition iscommand: false brand: "" nexttasks: '#default#': - "41" "No": - "44" "Yes": - "26" separatecontext: false conditions: - label: "Yes" condition: - - operator: isNotEmpty left: value: simple: inputs.IP iscontext: true right: value: {} - - operator: isEqualString left: value: simple: inputs.ExecutedFromParent iscontext: true right: value: simple: "True" ignorecase: true - label: "No" condition: - - operator: isNotEmpty left: value: complex: root: inputs.IP iscontext: true view: |- { "position": { "x": 170, "y": 330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 8556e257-fee3-46d6-8e63-e06c38c3b7af type: condition task: id: 8556e257-fee3-46d6-8e63-e06c38c3b7af version: -1 name: Resolve the IP address? description: Checks whether the ResolveIP parameter is set to "True". type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" "yes": - "35" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.ResolveIP iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 720, "y": 1020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: abe79100-1944-48db-8ada-f7f05dff4f91 type: regular task: id: abe79100-1944-48db-8ada-f7f05dff4f91 version: -1 name: IP to Hostname (DNS) description: Convert the IP address to a hostname using DNS query. scriptName: IPToHost type: regular iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: ip: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "yes" - - operator: containsGeneral left: value: simple: IP.Address iscontext: true right: value: simple: inputs.IP iscontext: true accessor: Address transformers: - operator: uniq reputationcalc: 2 separatecontext: false view: |- { "position": { "x": 720, "y": 1210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: ac707a9d-ef3d-4dbc-867d-1bef4287be9d type: condition task: id: ac707a9d-ef3d-4dbc-867d-1bef4287be9d version: -1 name: Is there an internal IP address? description: Checks whether the "InRange" attribute is set to "yes". type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "34" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "yes" ignorecase: true accessor: Address transformers: - operator: uniq iscontext: true right: value: {} view: |- { "position": { "x": 720, "y": 840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: 711a6f17-1f6f-4b1f-86d6-2808ea6ea255 type: regular task: id: 711a6f17-1f6f-4b1f-86d6-2808ea6ea255 version: -1 name: Determine whether the IP address is internal or external description: "Checks if the IP address is in the internal IP address ranges.\nIf internal, sets the \"InRange\" attribute to \"yes\".\nIf external, sets the \"InRange\" attribute to \"no\". \n" scriptName: IsIPInRanges type: regular iscommand: false brand: "" nexttasks: '#none#': - "39" scriptarguments: ip: complex: root: inputs.IP transformers: - operator: uniq ipRanges: complex: root: inputs.InternalRange transformers: - operator: uniq reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 720, "y": 680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 3dbd6139-a053-466c-8abf-86544d804022 type: title task: id: 3dbd6139-a053-466c-8abf-86544d804022 version: -1 name: No Internal IP Address type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "24" separatecontext: false view: |- { "position": { "x": -580, "y": 855 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: 955e1140-bb51-446f-86e3-754d5119635b type: playbook task: id: 955e1140-bb51-446f-86e3-754d5119635b version: -1 name: Endpoint Enrichment - Generic v2.1 playbookName: Endpoint Enrichment - Generic v2.1 type: playbook iscommand: false brand: "" description: |- Enrich an endpoint by hostname using one or more integrations. Supported integrations: - Active Directory Query v2 - McAfee ePO v2 - VMware Carbon Black EDR v2 - Cylance Protect v2 - CrowdStrike Falcon - ExtraHop Reveal(x) - Cortex XDR / Core (endpoint enrichment, reputation and risk) - Endpoint reputation using !endpoint command. nexttasks: '#none#': - "24" scriptarguments: Hostname: complex: root: Endpoint filters: - - operator: inList left: value: simple: Endpoint.IP iscontext: true right: value: simple: inputs.IP iscontext: true accessor: Hostname transformers: - operator: AppendIfNotEmpty args: item: value: simple: inputs.Hostnames iscontext: true raw: {} - operator: uniq IPAddress: complex: root: IP.Address filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "yes" ignorecase: true - - operator: in left: value: simple: IP.Address iscontext: true right: value: simple: inputs.IP iscontext: true ignorecase: true transformers: - operator: uniq UseReputationCommand: simple: "True" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 170, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: 7be14457-6daf-4880-8ab7-ddc7d9c5f5ea type: title task: id: 7be14457-6daf-4880-8ab7-ddc7d9c5f5ea version: -1 name: Classify & Resolve IPs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "40" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": 540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "28_26_Yes": 0.17, "28_41_#default#": 0.27, "34_26_#default#": 0.41, "39_34_yes": 0.47 }, "paper": { "dimensions": { "height": 1636, "width": 1970, "x": -580, "y": 199 } } } inputs: - key: IP value: complex: root: IP accessor: Address transformers: - operator: uniq required: false description: The IP address to enrich. playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: "A comma-separated list of IP address ranges (in CIDR notation). Use this list to check if an IP address is found within a set of IP address ranges. \nFor example: \"172.16.0.0/12,10.0.0.0/8,192.168.0.0/16\" (without quotes)." playbookInputQuery: - key: ResolveIP value: complex: root: inputs.ResolveIP required: true description: |- Whether to convert the IP address to a hostname using a DNS query (True/False). The default value is true. playbookInputQuery: - key: ExecutedFromParent value: simple: "False" required: false description: |- Whether to execute common logic, like the classification of IP addresses to ranges and resolving, in the the main (IP Enrichment - Generic v2) enrichment playbook, instead of in the sub-playbooks. Possible values are: True, False. Setting this to True will execute the relevant commands in the main playbook instead of executing them in both sub-playbooks. Set this to True in the parent playbook if you are using the parent playbook, as opposed to using the sub-playbooks directly in your playbooks, as this will improve the performance of the playbook and reduce the overfall size of the incident. playbookInputQuery: - key: Hostnames value: {} required: false description: Hostnames to enrich. If the ExecutedFromParent playbook is set to True in the IP - Enrichment - Generic v2 playbook, and an internal IP resolves to an endpoint hostname that you want to enrich, the hostnames defined here will be used. playbookInputQuery: outputs: - contextPath: IP description: The IP objects. type: unknown - contextPath: DBotScore description: Indicator, Score, Type and Vendor. type: unknown - contextPath: Endpoint description: The endpoint's object. type: unknown - contextPath: Endpoint.Hostname description: The hostname to enrich. type: string - contextPath: Endpoint.OS description: Endpoint operating system. type: string - contextPath: Endpoint.IP description: A list of endpoint IP addresses. - contextPath: Endpoint.MAC description: A list of endpoint MAC addresses. - contextPath: Endpoint.Domain description: Endpoint domain name. type: string - contextPath: Endpoint.ID description: The endpoint ID. type: string - contextPath: Endpoint.Status description: The endpoint status. type: string - contextPath: Endpoint.IsIsolated description: The endpoint isolation status. type: string - contextPath: Endpoint.MACAddress description: The endpoint MAC address. type: string - contextPath: Endpoint.Vendor description: The integration name of the endpoint vendor. type: string - contextPath: Endpoint.Relationships description: The endpoint relationships of the endpoint that was enriched. type: string - contextPath: Endpoint.Processor description: The model of the processor. type: string - contextPath: Endpoint.Processors description: The number of processors. type: string - contextPath: Endpoint.Memory description: Memory on this endpoint. type: string - contextPath: Endpoint.Model description: The model of the machine or device. type: string - contextPath: Endpoint.BIOSVersion description: The endpoint's BIOS version. type: string - contextPath: Endpoint.OSVersion description: The endpoint's operation system version. type: string - contextPath: Endpoint.DHCPServer description: The DHCP server of the endpoint. type: string - contextPath: Endpoint.Groups description: Groups for which the computer is listed as a member. type: string - contextPath: ExtraHop.Device.Macaddr description: The MAC Address of the device. type: String - contextPath: ExtraHop.Device.DeviceClass description: The class of the device. type: String - contextPath: ExtraHop.Device.UserModTime description: The time of the most recent update, expressed in milliseconds since the epoch. type: Number - contextPath: ExtraHop.Device.AutoRole description: The role automatically detected by the ExtraHop. type: String - contextPath: ExtraHop.Device.ParentId description: The ID of the parent device. type: Number - contextPath: ExtraHop.Device.Vendor description: The device vendor. type: String - contextPath: ExtraHop.Device.Analysis description: The level of analysis preformed on the device. type: string - contextPath: ExtraHop.Device.DiscoveryId description: The UUID given by the Discover appliance. type: String - contextPath: ExtraHop.Device.DefaultName description: The default name of the device. type: String - contextPath: ExtraHop.Device.DisplayName description: The display name of device. type: String - contextPath: ExtraHop.Device.OnWatchlist description: Whether the device is on the advanced analysis allow list. type: Boolean - contextPath: ExtraHop.Device.ModTime description: The time of the most recent update, expressed in milliseconds since the epoch. type: Number - contextPath: ExtraHop.Device.IsL3 description: Indicates whether the device is a Layer 3 device. type: Boolean - contextPath: ExtraHop.Device.Role description: The role of the device. type: String - contextPath: ExtraHop.Device.DiscoverTime description: The time that the device was discovered. type: Number - contextPath: ExtraHop.Device.Id description: The ID of the device. type: Number - contextPath: ExtraHop.Device.Ipaddr4 description: The IPv4 address of the device. type: String - contextPath: ExtraHop.Device.Vlanid description: The ID of VLan. type: Number - contextPath: ExtraHop.Device.Ipaddr6 description: The IPv6 address of the device. type: string - contextPath: ExtraHop.Device.NodeId description: The Node ID of the Discover appliance. type: number - contextPath: ExtraHop.Device.Description description: A user customizable description of the device. type: string - contextPath: ExtraHop.Device.DnsName description: The DNS name associated with the device. type: string - contextPath: ExtraHop.Device.DhcpName description: The DHCP name associated with the device. type: string - contextPath: ExtraHop.Device.CdpName description: The Cisco Discovery Protocol name associated with the device. type: string - contextPath: ExtraHop.Device.NetbiosName description: The NetBIOS name associated with the device. type: string - contextPath: ExtraHop.Device.Url description: Link to the device details page in ExtraHop. type: string - contextPath: McAfee.ePO.Endpoint description: The endpoint that was enriched. type: string - contextPath: ActiveDirectory.ComputersPageCookie description: An opaque string received in a paged search, used for requesting subsequent entries. type: string - contextPath: ActiveDirectory.Computers description: The information about the hostname that was enriched using Active Directory. type: string - contextPath: ActiveDirectory.Computers.dn description: The computer distinguished name. type: string - contextPath: ActiveDirectory.Computers.memberOf description: Groups for which the computer is listed. type: string - contextPath: ActiveDirectory.Computers.name description: The computer name. type: string - contextPath: CrowdStrike.Device description: The information about the endpoint. type: string - contextPath: CarbonBlackEDR.Sensor.systemvolume_total_size description: The size, in bytes, of the system volume of the endpoint on which the sensor is installed. installed. type: number - contextPath: CarbonBlackEDR.Sensor.emet_telemetry_path description: The path of the EMET telemetry associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.os_environment_display_string description: Human-readable string of the installed OS. type: string - contextPath: CarbonBlackEDR.Sensor.emet_version description: The EMET version associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.emet_dump_flags description: The flags of the EMET dump associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.clock_delta description: The clock delta associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.supports_cblr description: Whether the sensor supports Carbon Black Live Response (CbLR). type: string - contextPath: CarbonBlackEDR.Sensor.sensor_uptime description: The uptime of the process. type: string - contextPath: CarbonBlackEDR.Sensor.last_update description: When the sensor was last updated. type: string - contextPath: CarbonBlackEDR.Sensor.physical_memory_size description: The size in bytes of physical memory. type: number - contextPath: CarbonBlackEDR.Sensor.build_id description: The sensor version installed on this endpoint. From the /api/builds/ endpoint. type: string - contextPath: CarbonBlackEDR.Sensor.uptime description: Endpoint uptime in seconds. type: string - contextPath: CarbonBlackEDR.Sensor.is_isolating description: Boolean representing sensor-reported isolation status. type: boolean - contextPath: CarbonBlackEDR.Sensor.event_log_flush_time description: |- If event_log_flush_time is set, the server will instruct the sensor to immediately send all data before this date, ignoring all other throttling mechanisms. To force a host current, set this value to a value far in the future. When the sensor has finished sending its queued data, this value will be null. type: string - contextPath: CarbonBlackEDR.Sensor.computer_dns_name description: The DNS name of the endpoint on which the sensor is installed. type: string - contextPath: CarbonBlackEDR.Sensor.emet_report_setting description: The report setting of the EMET associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.id description: The ID of this sensor. type: string - contextPath: CarbonBlackEDR.Sensor.emet_process_count description: The number of EMET processes associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.emet_is_gpo description: Whether the EMET is a GPO. type: string - contextPath: CarbonBlackEDR.Sensor.power_state description: The sensor power state. type: string - contextPath: CarbonBlackEDR.Sensor.network_isolation_enabled description: Boolean representing the network isolation request status. type: boolean - contextPath: CarbonBlackEDR.Sensor.systemvolume_free_size description: The amount of free bytes on the system volume. type: string - contextPath: CarbonBlackEDR.Sensor.status description: The sensor status. type: string - contextPath: CarbonBlackEDR.Sensor.num_eventlog_bytes description: The number of event log bytes. type: number - contextPath: CarbonBlackEDR.Sensor.sensor_health_message description: Human-readable string indicating the sensor’s self-reported status. type: string - contextPath: CarbonBlackEDR.Sensor.build_version_string description: Human-readable string of the sensor version. type: string - contextPath: CarbonBlackEDR.Sensor.computer_sid description: Machine SID of this host. type: string - contextPath: CarbonBlackEDR.Sensor.next_checkin_time description: Next expected communication from this computer in server-local time and zone. type: string - contextPath: CarbonBlackEDR.Sensor.node_id description: The node ID associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.cookie description: The cookie associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.emet_exploit_action description: The EMET exploit action associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.computer_name description: NetBIOS name of this computer. type: string - contextPath: CarbonBlackEDR.Sensor.license_expiration description: When the license of the sensor expires. type: string - contextPath: CarbonBlackEDR.Sensor.supports_isolation description: Whether the sensor supports isolation. type: string - contextPath: CarbonBlackEDR.Sensor.parity_host_id description: The ID of the parity host associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.supports_2nd_gen_modloads description: Whether the sensor support modload of 2nd generation. type: string - contextPath: CarbonBlackEDR.Sensor.network_adapters description: A pipe-delimited list of IP,MAC pairs for each network interface. type: string - contextPath: CarbonBlackEDR.Sensor.sensor_health_status description: Self-reported health score, from 0 to 100. Higher numbers indicate a better health status. type: number - contextPath: CarbonBlackEDR.Sensor.registration_time description: Time this sensor was originally registered in server-local time and zone. type: string - contextPath: CarbonBlackEDR.Sensor.restart_queued description: Whether a restart of the sensor is queued. type: string - contextPath: CarbonBlackEDR.Sensor.notes description: The notes associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.num_storefiles_bytes description: Number of storefiles bytes associated with the sensor. type: number - contextPath: CarbonBlackEDR.Sensor.os_environment_id description: The ID of the OS environment of the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.shard_id description: The ID of the shard associated with the sensor. type: string - contextPath: CarbonBlackEDR.Sensor.boot_id description: A sequential counter of boots since the sensor was installed. type: string - contextPath: CarbonBlackEDR.Sensor.last_checkin_time description: Last communication with this computer in server-local time and zone. type: string - contextPath: CarbonBlackEDR.Sensor.os_type description: The operating system type of the computer. type: string - contextPath: CarbonBlackEDR.Sensor.group_id description: The sensor group ID this sensor is assigned to. type: string - contextPath: CarbonBlackEDR.Sensor.uninstall description: When set, indicates that the sensor will be directed to uninstall on next check-in. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id description: The endpoint ID. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name description: The endpoint name. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_type description: The endpoint type. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status description: The status of the endpoint. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.os_type description: The endpoint OS type. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.ip description: A list of IP addresses. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.users description: A list of users. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.domain description: The endpoint domain. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.alias description: The endpoint's aliases. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.first_seen description: First seen date/time in Epoch (milliseconds). type: string - contextPath: PaloAltoNetworksXDR.Endpoint.last_seen description: Last seen date/time in Epoch (milliseconds). type: string - contextPath: PaloAltoNetworksXDR.Endpoint.content_version description: Content version. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.installation_package description: Installation package. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.active_directory description: Active directory. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.install_date description: Install date in Epoch (milliseconds). type: date - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_version description: Endpoint version. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated description: Whether the endpoint is isolated. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.group_name description: The name of the group to which the endpoint belongs. type: string - contextPath: PaloAltoNetworksXDR.Endpoint.count description: Number of endpoints returned. type: number - contextPath: Account.Username description: The username in the relevant system. type: string - contextPath: Account.Domain description: The domain of the account. type: string - contextPath: PaloAltoNetworksXDR.RiskyHost.type description: Form of identification element. type: string - contextPath: PaloAltoNetworksXDR.RiskyHost.id description: Identification value of the type field. type: string - contextPath: PaloAltoNetworksXDR.RiskyHost.score description: The score assigned to the host. type: string - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons description: The endpoint risk objects. type: string - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.date created description: Date when the incident was created. type: date - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.description description: Description of the incident. type: string - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.severity description: The severity of the incident. type: string - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.status description: The incident status. type: string - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.points description: The score. type: string - contextPath: Core.Endpoint.endpoint_id description: The endpoint ID. type: string - contextPath: Core.Endpoint.endpoint_name description: The endpoint name. type: string - contextPath: Core.Endpoint.endpoint_type description: The endpoint type. type: string - contextPath: Core.Endpoint.endpoint_status description: The status of the endpoint. type: string - contextPath: Core.Endpoint.os_type description: The endpoint OS type. type: string - contextPath: Core.Endpoint.ip description: A list of IP addresses. type: string - contextPath: Core.Endpoint.users description: A list of users. type: string - contextPath: Core.Endpoint.domain description: The endpoint domain. type: string - contextPath: Core.Endpoint.alias description: The endpoint's aliases. type: string - contextPath: Core.Endpoint.first_seen description: First seen date/time in Epoch (milliseconds). type: string - contextPath: Core.Endpoint.last_seen description: Last seen date/time in Epoch (milliseconds). type: string - contextPath: Core.Endpoint.content_version description: Content version. type: string - contextPath: Core.Endpoint.installation_package description: Installation package. type: string - contextPath: Core.Endpoint.active_directory description: Active directory. type: string - contextPath: Core.Endpoint.install_date description: Install date in Epoch (milliseconds). type: date - contextPath: Core.Endpoint.endpoint_version description: Endpoint version. type: string - contextPath: Core.Endpoint.is_isolated description: Whether the endpoint is isolated. type: string - contextPath: Core.Endpoint.group_name description: The name of the group to which the endpoint belongs. type: string - contextPath: Core.RiskyHost.type description: Form of identification element. type: string - contextPath: Core.RiskyHost.id description: Identification value of the type field. type: string - contextPath: Core.RiskyHost.score description: The score assigned to the host. type: string - contextPath: Core.RiskyHost.reasons description: The reasons for the risk level. type: string - contextPath: Core.RiskyHost.reasons.date created description: Date when the incident was created. type: date - contextPath: Core.RiskyHost.reasons.description description: Description of the incident. type: string - contextPath: Core.RiskyHost.reasons.severity description: The severity of the incident. type: string - contextPath: Core.RiskyHost.reasons.status description: The incident status. type: string - contextPath: Core.RiskyHost.reasons.points description: The score. type: string - contextPath: IP.Address description: The IP address. type: string - contextPath: IP.InRange description: Is the IP in the input ranges? (could be 'yes' or 'no). type: string fromversion: 5.0.0 tests: - IP Enrichment - Generic v2 - Test contentitemexportablefields: contentitemfields: {} system: true