diff --git a/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Classifier.json b/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Classifier.json index 3a4a3786a7a6..276313f43639 100644 --- a/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Classifier.json +++ b/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Classifier.json @@ -1,41 +1,23 @@ { - "brands": null, - "cacheVersn": 0, - "defaultIncidentType": "Sekoia XDR", - "definitionId": "", - "description": "", - "feed": false, - "fromServerVersion": "", - "id": "1c920299-9d19-4ed6-8994-d4eae30706c1", - "incidentSamples": null, - "indicatorSamples": null, - "instanceIds": null, - "itemVersion": "", - "keyTypeMap": { - "malware": "Sekoia XDR", - "masquerade": "Sekoia XDR", - "phishing": "Sekoia XDR", - "ransomware": "Sekoia XDR", - "system-compromise": "Sekoia XDR" - }, - "locked": false, - "logicalVersion": 4, - "mapping": null, - "name": "Sekoia XDR - Classifier", - "nameRaw": "Sekoia XDR - Classifier", - "packID": "", - "packName": "", - "propagationLabels": [ - "all" - ], - "sourceClassifierId": "", - "system": false, - "toServerVersion": "", - "transformer": { - "simple": "alert_type.value" - }, - "type": "classification", - "unclassifiedCases": null, - "version": -1, + "defaultIncidentType": "Sekoia XDR", + "description": "", + "feed": false, + "id": "Sekoia XDR - Classifier", + "keyTypeMap": { + "malware": "Sekoia XDR", + "masquerade": "Sekoia XDR", + "phishing": "Sekoia XDR", + "ransomware": "Sekoia XDR", + "system-compromise": "Sekoia XDR" + }, + "name": "Sekoia XDR - Classifier", + "propagationLabels": [ + "all" + ], + "transformer": { + "simple": "alert_type.value" + }, + "type": "classification", + "version": -1, "fromVersion": "6.10.0" } \ No newline at end of file diff --git a/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Incoming_Mapper.json b/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Incoming_Mapper.json index 76fa83c00ec9..0fab2645addb 100644 --- a/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Incoming_Mapper.json +++ b/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Incoming_Mapper.json @@ -1,387 +1,228 @@ { - "brands": null, - "cacheVersn": 0, - "defaultIncidentType": "", - "definitionId": "", - "description": "Maps incoming Sekoia XDR incidents fields.\n", - "feed": false, - "fromServerVersion": "6.0.0", - "id": "Sekoia XDR - Incoming Mapper", - "incidentSamples": null, - "indicatorSamples": null, - "instanceIds": null, - "itemVersion": "2.1.26", - "keyTypeMap": {}, - "locked": false, - "logicalVersion": 35, - "mapping": { - "Carbon Black EDR": { - "dontMapEventToLabels": true, - "internalMapping": { - "Carbon Black EDR IOC Value": { - "simple": "ioc_value" - }, - "Carbon Black EDR Segment ID": { - "simple": "segment_id" - }, - "Carbon Black EDR Unique ID": { - "simple": "unique_id" - }, - "Carbon Black EDR Watchlist Id": { - "simple": "watchlist_id" - }, - "Carbon Black EDR Watchlist Name": { - "simple": "watchlist_name" - }, - "Device External IP": { - "simple": "interface_ip" - }, - "Device Id": { - "simple": "sensor_id" - }, - "Device Name": { - "simple": "hostname" - }, - "Event Descriptions": { - "simple": "description" - }, - "Event Type": { - "simple": "alert_type" - }, - "Incident Link": { - "simple": "link" - }, - "Log Source": { - "simple": "feed_name" - }, - "MD5": { - "simple": "md5" - }, - "OS": { - "simple": "os_type" - }, - "PID": { - "simple": "process_id" - }, - "Process Name": { - "simple": "process_name" - }, - "Process Path": { - "simple": "process_path" - }, - "Resource Type": { - "simple": "ioc_type" - }, - "Username": { - "simple": "username" - }, - "severity": { - "simple": "alert_severity" - } - } - }, - "Sekoia XDR": { - "dontMapEventToLabels": true, - "internalMapping": { - "Alert Category": { - "simple": "alert_type.category" - }, - "Alert ID": { - "simple": "short_id" - }, - "Alert Name": { - "simple": "title" - }, - "Alert Type ID": { - "simple": "alert_type.value" - }, - "Alert UUID": { - "simple": "uuid" - }, - "Description": { - "simple": "details" - }, - "Sekoia Alert Details": { - "simple": "details" - }, - "Sekoia Alert Status": { - "simple": "status.name" - }, - "Sekoia Alert URL": { - "complex": { - "filters": [], - "root": "short_id", - "transformers": [ - { - "args": { - "prefix": { - "isContext": false, - "value": { - "simple": "https://app.sekoia.io/operations/alerts/" - } - }, - "suffix": { - "isContext": false - } - }, - "operator": "concat" - } - ] - } - }, - "Sekoia Events": { - "simple": "events.items" - }, - "Sekoia First Seen": { - "simple": "first_seen_at" - }, - "Sekoia Impacted Assets": { - "complex": { - "filters": [], - "root": "assets", - "transformers": [] - } - }, - "Sekoia Kill Chain": { - "complex": { - "filters": [], - "root": "kill_chain", - "transformers": [] - } - }, - "Sekoia Last Seen": { - "simple": "last_seen_at" - }, - "Source Create time": { - "complex": { - "filters": [], - "root": "created_at", - "transformers": [ - { - "operator": "TimeStampToDate" - } - ] - } - }, - "Source IP": { - "simple": "source" - }, - "dbotMirrorInstance": { - "simple": "mirror_instance" - }, - "test3": { - "complex": { - "filters": [], - "root": "created_at", - "transformers": [ - { - "args": { - "item": { - "isContext": true, - "value": { - "simple": "created_at" - } - } - }, - "operator": "append" - } - ] - } - } - } - }, - "Test": { - "dontMapEventToLabels": false, - "internalMapping": { - "Alert Category": { - "simple": "alert_type.category" - }, - "Alert ID": { - "simple": "short_id" - }, - "Alert Name": { - "simple": "title" - }, - "Alert Status": { - "simple": "status.name" - }, - "Alert Type ID": { - "simple": "alert_type.value" - }, - "Description": { - "simple": "details" - }, - "Sekoia Alert URL": { - "complex": { - "filters": [], - "root": "short_id", - "transformers": [ - { - "args": { - "prefix": { - "isContext": false, - "value": { - "simple": "https://app.sekoia.io/operations/alerts/" - } - }, - "suffix": { - "isContext": false - } - }, - "operator": "concat" - } - ] - } - }, - "Sekoia Events": { - "simple": "events.items" - }, - "Source Create time": { - "complex": { - "filters": [], - "root": "created_at", - "transformers": [ - { - "operator": "TimeStampToDate" - } - ] - } - }, - "Source IP": { - "simple": "source" - }, - "dbotMirrorInstance": { - "simple": "\"Sekoia XDR (beta)_copy_readWrite\"" - } - } - }, - "dbot_classification_incident_type_all": { - "dontMapEventToLabels": false, - "internalMapping": { - "Alert Category": { - "simple": "alert_type.category" - }, - "Alert ID": { - "simple": "short_id" - }, - "Alert Name": { - "simple": "title" - }, - "Alert Type ID": { - "simple": "alert_type.value" - }, - "Alert UUID": { - "simple": "uuid" - }, - "Description": { - "simple": "details" - }, - "Sekoia Alert Details": { - "simple": "details" - }, - "Sekoia Alert Status": { - "simple": "status.name" - }, - "Sekoia Alert URL": { - "complex": { - "filters": [], - "root": "short_id", - "transformers": [ - { - "args": { - "prefix": { - "isContext": false, - "value": { - "simple": "https://app.sekoia.io/operations/alerts/" - } - }, - "suffix": { - "isContext": false - } - }, - "operator": "concat" - } - ] - } - }, - "Sekoia CTI URL": { - "simple": "target" - }, - "Sekoia Events": { - "simple": "events.items" - }, - "Sekoia First Seen": { - "simple": "first_seen_at" - }, - "Sekoia Impacted Assets": { - "complex": { - "filters": [], - "root": "assets", - "transformers": [] - } - }, - "Sekoia Kill Chain": { - "complex": { - "filters": [], - "root": "kill_chain", - "transformers": [] - } - }, - "Sekoia Last Seen": { - "simple": "last_seen_at" - }, - "Source Create time": { - "complex": { - "filters": [], - "root": "created_at", - "transformers": [ - { - "operator": "TimeStampToDate" - } - ] - } - }, - "Source IP": { - "simple": "source" - }, - "dbotMirrorInstance": { - "simple": "mirror_instance" - }, - "test3": { - "complex": { - "filters": [], - "root": "created_at", - "transformers": [ - { - "args": { - "item": { - "isContext": true, - "value": { - "simple": "created_at" - } - } - }, - "operator": "append" - } - ] - } - } - } - } - }, - "name": "Sekoia XDR - Incoming Mapper", - "nameRaw": "Sekoia XDR - Incoming Mapper", - "packID": "", - "packName": "Carbon Black Enterprise Response", - "propagationLabels": [ - "all" - ], - "sourceClassifierId": "Carbon Black EDR Mapper", - "system": false, - "toServerVersion": "", - "transformer": {}, - "type": "mapping-incoming", - "unclassifiedCases": null, - "version": -1, + "description": "Maps incoming Sekoia XDR incidents fields.\n", + "feed": false, + "id": "Sekoia XDR - Incoming Mapper", + "mapping": { + "Carbon Black EDR": { + "dontMapEventToLabels": true, + "internalMapping": { + "Carbon Black EDR IOC Value": { + "simple": "ioc_value" + }, + "Carbon Black EDR Segment ID": { + "simple": "segment_id" + }, + "Carbon Black EDR Unique ID": { + "simple": "unique_id" + }, + "Carbon Black EDR Watchlist Id": { + "simple": "watchlist_id" + }, + "Carbon Black EDR Watchlist Name": { + "simple": "watchlist_name" + }, + "Device External IP": { + "simple": "interface_ip" + }, + "Device Id": { + "simple": "sensor_id" + }, + "Device Name": { + "simple": "hostname" + }, + "Event Descriptions": { + "simple": "description" + }, + "Event Type": { + "simple": "alert_type" + }, + "Incident Link": { + "simple": "link" + }, + "Log Source": { + "simple": "feed_name" + }, + "MD5": { + "simple": "md5" + }, + "OS": { + "simple": "os_type" + }, + "PID": { + "simple": "process_id" + }, + "Process Name": { + "simple": "process_name" + }, + "Process Path": { + "simple": "process_path" + }, + "Resource Type": { + "simple": "ioc_type" + }, + "Username": { + "simple": "username" + }, + "severity": { + "simple": "alert_severity" + } + } + }, + "Sekoia XDR": { + "dontMapEventToLabels": true, + "internalMapping": { + "Alert Category": { + "simple": "alert_type.category" + }, + "Alert ID": { + "simple": "short_id" + }, + "Alert Name": { + "simple": "title" + }, + "Alert Type ID": { + "simple": "alert_type.value" + }, + "Description": { + "simple": "details" + }, + "Sekoia Alert Details": { + "simple": "details" + }, + "Sekoia Alert Status": { + "simple": "status.name" + }, + "Sekoia First Seen": { + "simple": "first_seen_at" + }, + "Sekoia Kill Chain": { + "complex": { + "filters": [], + "root": "kill_chain", + "transformers": [] + } + }, + "Sekoia Last Seen": { + "simple": "last_seen_at" + }, + "Source Create time": { + "complex": { + "filters": [], + "root": "created_at", + "transformers": [ + { + "operator": "TimeStampToDate" + } + ] + } + }, + "Source IP": { + "simple": "source" + }, + "dbotMirrorInstance": { + "simple": "mirror_instance" + } + } + }, + "Test": { + "dontMapEventToLabels": false, + "internalMapping": { + "Alert Category": { + "simple": "alert_type.category" + }, + "Alert ID": { + "simple": "short_id" + }, + "Alert Name": { + "simple": "title" + }, + "Alert Type ID": { + "simple": "alert_type.value" + }, + "Description": { + "simple": "details" + }, + "Source Create time": { + "complex": { + "filters": [], + "root": "created_at", + "transformers": [ + { + "operator": "TimeStampToDate" + } + ] + } + }, + "Source IP": { + "simple": "source" + }, + "dbotMirrorInstance": { + "simple": "\"Sekoia XDR (beta)_copy_readWrite\"" + } + } + }, + "dbot_classification_incident_type_all": { + "dontMapEventToLabels": false, + "internalMapping": { + "Alert Category": { + "simple": "alert_type.category" + }, + "Alert ID": { + "simple": "short_id" + }, + "Alert Name": { + "simple": "title" + }, + "Alert Type ID": { + "simple": "alert_type.value" + }, + "Description": { + "simple": "details" + }, + "Sekoia Alert Details": { + "simple": "details" + }, + "Sekoia Alert Status": { + "simple": "status.name" + }, + "Sekoia CTI URL": { + "simple": "target" + }, + "Sekoia First Seen": { + "simple": "first_seen_at" + }, + "Sekoia Kill Chain": { + "complex": { + "filters": [], + "root": "kill_chain", + "transformers": [] + } + }, + "Sekoia Last Seen": { + "simple": "last_seen_at" + }, + "Source Create time": { + "complex": { + "filters": [], + "root": "created_at", + "transformers": [ + { + "operator": "TimeStampToDate" + } + ] + } + }, + "Source IP": { + "simple": "source" + }, + "dbotMirrorInstance": { + "simple": "mirror_instance" + } + } + } + }, + "name": "Sekoia XDR - Incoming Mapper", + "type": "mapping-incoming", + "version": -1, "fromVersion": "6.10.0" } \ No newline at end of file diff --git a/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Outgoing_Mapper.json b/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Outgoing_Mapper.json index f54f2dd9d4c4..f2b3cd980993 100644 --- a/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Outgoing_Mapper.json +++ b/Packs/SekoiaXDR/Classifiers/classifier-Sekoia_XDR_-_Outgoing_Mapper.json @@ -1,62 +1,33 @@ { - "brands": null, - "cacheVersn": 0, - "defaultIncidentType": "", - "definitionId": "", - "description": "Maps outgoing Sekoia XDR incidents fields.", - "feed": false, - "fromServerVersion": "", - "id": "Sekoia XDR - Outgoing Mapper", - "incidentSamples": null, - "indicatorSamples": null, - "instanceIds": null, - "itemVersion": "", - "keyTypeMap": {}, - "locked": false, - "logicalVersion": 9, - "mapping": { - "Sekoia XDR": { - "dontMapEventToLabels": false, - "internalMapping": { - "short_id": { - "simple": "alertid" - }, - "status": { - "simple": "sekoiaalertstatus" - }, - "xsoar_id": { - "simple": "id" - } - } - }, - "dbot_classification_incident_type_all": { - "dontMapEventToLabels": false, - "internalMapping": { - "short_id": { - "simple": "dbotMirrorId" - }, - "status": { - "simple": "status" - }, - "xsoar_id": { - "simple": "id" - } - } - } - }, - "name": "Sekoia XDR - Outgoing Mapper", - "nameRaw": "Sekoia XDR - Outgoing Mapper", - "packID": "", - "packName": "", - "propagationLabels": [ - "all" - ], - "sourceClassifierId": "", - "system": false, - "toServerVersion": "", - "transformer": {}, - "type": "mapping-outgoing", - "unclassifiedCases": null, - "version": -1, + "description": "Maps outgoing Sekoia XDR incidents fields.", + "feed": false, + "id": "Sekoia XDR - Outgoing Mapper", + "mapping": { + "Sekoia XDR": { + "dontMapEventToLabels": false, + "internalMapping": { + "short_id": { + "simple": "alertid" + }, + "xsoar_id": { + "simple": "id" + } + } + }, + "dbot_classification_incident_type_all": { + "dontMapEventToLabels": false, + "internalMapping": { + "short_id": { + "simple": "dbotMirrorId" + }, + "xsoar_id": { + "simple": "id" + } + } + } + }, + "name": "Sekoia XDR - Outgoing Mapper", + "type": "mapping-outgoing", + "version": -1, "fromVersion": "6.10.0" } \ No newline at end of file diff --git a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_alertdetails_field.json b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_alertdetails_field.json index cf808a1c26ab..d6e285bec10f 100644 --- a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_alertdetails_field.json +++ b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_alertdetails_field.json @@ -1,62 +1,28 @@ { "id": "incident_sekoiaalertdetails", - "version": 1, - "cacheVersn": 0, + "version": -1, "modified": "2024-07-02T13:34:47.794510655Z", - "created": "2024-07-02T13:34:47.791018285Z", - "sizeInBytes": 0, - "packID": "", - "packName": "", - "itemVersion": "", - "fromServerVersion": "", - "toServerVersion": "", - "definitionId": "", - "vcShouldIgnore": false, - "vcShouldKeepItemLegacyProdMachine": false, - "commitMessage": "", - "shouldCommit": false, "name": "Sekoia Alert Details", - "prevName": "Sekoia Alert Details", "ownerOnly": false, - "placeholder": "", - "template": "", - "description": "", "cliName": "sekoiaalertdetails", "type": "markdown", - "orgType": "markdown", "closeForm": false, "editForm": true, "required": false, - "script": "", - "runScriptAfterUpdate": false, - "fieldCalcScript": "", "neverSetAsRequired": false, "isReadOnly": false, - "selectValues": [], - "autoCompleteTags": null, - "validationRegex": "", - "x2_fields": "", "useAsKpi": false, "locked": false, "system": false, - "content": false, + "content": true, "group": 0, - "mergeStrategy": "", "hidden": false, "openEnded": false, - "associatedTypes": [], - "systemAssociatedTypes": null, "associatedToAll": true, "unmapped": false, "unsearchable": true, "caseInsensitive": true, - "columns": null, - "defaultRows": null, "sla": 0, "threshold": 72, - "breachScript": "", - "validatedError": "", - "aliases": null, - "aliasTo": "", "fromVersion": "6.10.0" -} +} \ No newline at end of file diff --git a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_alertstatus_field.json b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_alertstatus_field.json index f27969b71cc0..42c916eace8c 100644 --- a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_alertstatus_field.json +++ b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_alertstatus_field.json @@ -1,62 +1,28 @@ { "id": "incident_sekoiaalertstatus", - "version": 1, - "cacheVersn": 0, + "version": -1, "modified": "2024-07-02T13:34:47.866877854Z", - "created": "2024-07-02T13:34:47.863529049Z", - "sizeInBytes": 0, - "packID": "", - "packName": "", - "itemVersion": "", - "fromServerVersion": "", - "toServerVersion": "", - "definitionId": "", - "vcShouldIgnore": false, - "vcShouldKeepItemLegacyProdMachine": false, - "commitMessage": "", - "shouldCommit": false, "name": "Sekoia Alert Status", - "prevName": "Sekoia Alert Status", "ownerOnly": false, - "placeholder": "", - "template": "", - "description": "", "cliName": "sekoiaalertstatus", "type": "shortText", - "orgType": "singleSelect", "closeForm": false, "editForm": true, "required": false, - "script": "", - "runScriptAfterUpdate": false, - "fieldCalcScript": "", "neverSetAsRequired": false, "isReadOnly": false, - "selectValues": [], - "autoCompleteTags": null, - "validationRegex": "", - "x2_fields": "", "useAsKpi": false, "locked": false, "system": false, - "content": false, + "content": true, "group": 0, - "mergeStrategy": "", "hidden": false, "openEnded": false, - "associatedTypes": [], - "systemAssociatedTypes": null, "associatedToAll": true, "unmapped": false, "unsearchable": false, "caseInsensitive": true, - "columns": null, - "defaultRows": null, "sla": 0, "threshold": 72, - "breachScript": "", - "validatedError": "", - "aliases": null, - "aliasTo": "", "fromVersion": "6.10.0" -} +} \ No newline at end of file diff --git a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_ctiurl_field.json b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_ctiurl_field.json index 21fd008e7500..e45f629ce6d4 100644 --- a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_ctiurl_field.json +++ b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_ctiurl_field.json @@ -1,62 +1,28 @@ { "id": "incident_sekoiactiurl", - "version": 1, - "cacheVersn": 0, + "version": -1, "modified": "2024-07-09T08:31:43.252403414Z", - "created": "0001-01-01T00:00:00Z", - "sizeInBytes": 0, - "packID": "", - "packName": "", - "itemVersion": "", - "fromServerVersion": "", - "toServerVersion": "", - "definitionId": "", - "vcShouldIgnore": false, - "vcShouldKeepItemLegacyProdMachine": false, - "commitMessage": "", - "shouldCommit": false, "name": "Sekoia CTI URL", - "prevName": "Sekoia CTI URL", "ownerOnly": false, - "placeholder": "", - "template": "", - "description": "", "cliName": "sekoiactiurl", "type": "url", - "orgType": "url", "closeForm": false, "editForm": true, "required": false, - "script": "", - "runScriptAfterUpdate": false, - "fieldCalcScript": "", "neverSetAsRequired": false, "isReadOnly": false, - "selectValues": null, - "autoCompleteTags": null, - "validationRegex": "", - "x2_fields": "", "useAsKpi": false, "locked": false, "system": false, - "content": false, + "content": true, "group": 0, - "mergeStrategy": "", "hidden": false, "openEnded": false, - "associatedTypes": null, - "systemAssociatedTypes": null, "associatedToAll": true, "unmapped": false, "unsearchable": false, "caseInsensitive": true, - "columns": null, - "defaultRows": null, "sla": 0, "threshold": 72, - "breachScript": "", - "validatedError": "", - "aliases": null, - "aliasTo": "", "fromVersion": "6.10.0" -} +} \ No newline at end of file diff --git a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_firstseen_field.json b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_firstseen_field.json index 7ddffc23c530..6729261f10ed 100644 --- a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_firstseen_field.json +++ b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_firstseen_field.json @@ -1,63 +1,28 @@ - { "id": "incident_sekoiafirstseen", - "version": 1, - "cacheVersn": 0, + "version": -1, "modified": "2024-07-02T13:34:47.978554181Z", - "created": "2024-07-02T13:34:47.975167972Z", - "sizeInBytes": 0, - "packID": "", - "packName": "", - "itemVersion": "", - "fromServerVersion": "", - "toServerVersion": "", - "definitionId": "", - "vcShouldIgnore": false, - "vcShouldKeepItemLegacyProdMachine": false, - "commitMessage": "", - "shouldCommit": false, "name": "Sekoia First Seen", - "prevName": "Sekoia First Seen", "ownerOnly": false, - "placeholder": "", - "template": "", - "description": "", "cliName": "sekoiafirstseen", "type": "shortText", - "orgType": "shortText", "closeForm": false, "editForm": true, "required": false, - "script": "", - "runScriptAfterUpdate": false, - "fieldCalcScript": "", "neverSetAsRequired": false, "isReadOnly": false, - "selectValues": null, - "autoCompleteTags": null, - "validationRegex": "", - "x2_fields": "", "useAsKpi": false, "locked": false, "system": false, - "content": false, + "content": true, "group": 0, - "mergeStrategy": "", "hidden": false, "openEnded": false, - "associatedTypes": null, - "systemAssociatedTypes": null, "associatedToAll": true, "unmapped": false, "unsearchable": false, "caseInsensitive": true, - "columns": null, - "defaultRows": null, "sla": 0, "threshold": 72, - "breachScript": "", - "validatedError": "", - "aliases": null, - "aliasTo": "", "fromVersion": "6.10.0" -} +} \ No newline at end of file diff --git a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_killchain_field.json b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_killchain_field.json index 7c9900dfd0d8..fc5f61cebba8 100644 --- a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_killchain_field.json +++ b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_killchain_field.json @@ -1,53 +1,23 @@ { "id": "incident_sekoiakillchain", - "version": 1, - "cacheVersn": 0, - "sequenceNumber": 9963502, - "primaryTerm": 1, + "version": -1, "modified": "2024-07-02T13:34:48.058774798Z", - "created": "2024-07-02T13:34:48.055405793Z", - "sizeInBytes": 0, - "packID": "", - "packName": "", - "itemVersion": "", - "fromServerVersion": "", - "toServerVersion": "", - "definitionId": "", - "vcShouldIgnore": false, - "vcShouldKeepItemLegacyProdMachine": false, - "commitMessage": "", - "shouldCommit": false, "name": "Sekoia Kill Chain", - "prevName": "Sekoia Kill Chain", "ownerOnly": false, - "placeholder": "", - "template": "", - "description": "", "cliName": "sekoiakillchain", "type": "grid", - "orgType": "grid", "closeForm": false, "editForm": true, "required": false, - "script": "", - "runScriptAfterUpdate": false, - "fieldCalcScript": "", "neverSetAsRequired": false, "isReadOnly": true, - "selectValues": [], - "autoCompleteTags": null, - "validationRegex": "", - "x2_fields": "", "useAsKpi": false, "locked": false, "system": false, - "content": false, + "content": true, "group": 0, - "mergeStrategy": "", "hidden": false, "openEnded": false, - "associatedTypes": [], - "systemAssociatedTypes": null, "associatedToAll": true, "unmapped": false, "unsearchable": false, @@ -85,9 +55,5 @@ ], "sla": 0, "threshold": 72, - "breachScript": "", - "validatedError": "", - "aliases": null, - "aliasTo": "", "fromVersion": "6.10.0" } \ No newline at end of file diff --git a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_lastsseen_field.json b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_lastsseen_field.json index e2528ccf2992..2be7f333597d 100644 --- a/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_lastsseen_field.json +++ b/Packs/SekoiaXDR/IncidentFields/incident_sekoia_xdr_lastsseen_field.json @@ -1,62 +1,28 @@ { "id": "incident_sekoialastseen", - "version": 1, - "cacheVersn": 0, + "version": -1, "modified": "2024-07-02T13:34:48.098958091Z", - "created": "2024-07-02T13:34:48.095662621Z", - "sizeInBytes": 0, - "packID": "", - "packName": "", - "itemVersion": "", - "fromServerVersion": "", - "toServerVersion": "", - "definitionId": "", - "vcShouldIgnore": false, - "vcShouldKeepItemLegacyProdMachine": false, - "commitMessage": "", - "shouldCommit": false, "name": "Sekoia Last Seen", - "prevName": "Sekoia Last Seen", "ownerOnly": false, - "placeholder": "", - "template": "", - "description": "", "cliName": "sekoialastseen", "type": "shortText", - "orgType": "shortText", "closeForm": false, "editForm": true, "required": false, - "script": "", - "runScriptAfterUpdate": false, - "fieldCalcScript": "", "neverSetAsRequired": false, "isReadOnly": false, - "selectValues": null, - "autoCompleteTags": null, - "validationRegex": "", - "x2_fields": "", "useAsKpi": false, "locked": false, "system": false, - "content": false, + "content": true, "group": 0, - "mergeStrategy": "", "hidden": false, "openEnded": false, - "associatedTypes": null, - "systemAssociatedTypes": null, "associatedToAll": true, "unmapped": false, "unsearchable": false, "caseInsensitive": true, - "columns": null, - "defaultRows": null, "sla": 0, "threshold": 72, - "breachScript": "", - "validatedError": "", - "aliases": null, - "aliasTo": "", "fromVersion": "6.10.0" -} +} \ No newline at end of file diff --git a/Packs/SekoiaXDR/IncidentTypes/Sekoia_XDR_Incident_Types.json b/Packs/SekoiaXDR/IncidentTypes/Sekoia_XDR_Incident_Types.json index 2edb89c0c400..ab5d850515f6 100644 --- a/Packs/SekoiaXDR/IncidentTypes/Sekoia_XDR_Incident_Types.json +++ b/Packs/SekoiaXDR/IncidentTypes/Sekoia_XDR_Incident_Types.json @@ -1,25 +1,11 @@ { "id": "Sekoia XDR", - "version": 4, - "cacheVersn": 0, - "modified": "2024-07-08T14:03:22.887547824Z", - "created": "0001-01-01T00:00:00Z", - "sizeInBytes": 0, - "packID": "", - "packName": "", - "itemVersion": "", - "fromServerVersion": "", - "toServerVersion": "", - "definitionId": "", + "version": -1, "vcShouldIgnore": false, - "vcShouldKeepItemLegacyProdMachine": false, - "commitMessage": "", - "shouldCommit": false, "locked": false, "name": "Sekoia XDR", "prevName": "Sekoia XDR", "color": "#CFD0D0", - "playbookId": "665d55dc-9455-4745-8a9b-e72374b873a5", "hours": 0, "days": 0, "weeks": 0, @@ -30,7 +16,6 @@ "readonly": false, "default": false, "autorun": true, - "preProcessingScript": "", "closureScript": "0fa7a002-c00c-45c8-80ab-a7ebcfaa11f7", "disabled": false, "reputationCalc": 2, @@ -50,4 +35,4 @@ } }, "fromVersion": "6.10.0" -} +} \ No newline at end of file diff --git a/Packs/SekoiaXDR/Layouts/layoutscontainer-Sekoia_XDR_Layout.json b/Packs/SekoiaXDR/Layouts/layoutscontainer-Sekoia_XDR_Layout.json index 40be2c978642..4049b3784d65 100644 --- a/Packs/SekoiaXDR/Layouts/layoutscontainer-Sekoia_XDR_Layout.json +++ b/Packs/SekoiaXDR/Layouts/layoutscontainer-Sekoia_XDR_Layout.json @@ -1,1752 +1,1687 @@ { - "cacheVersn": 0, - "close": { - "sections": [ - { - "description": "", - "fields": [ - { - "fieldId": "incident_sekoiaalertreject", - "isVisible": true - }, - { - "fieldId": "incident_closereason", - "isVisible": true - }, - { - "fieldId": "incident_closenotes", - "isVisible": true - }, - { - "fieldId": "incident_owner", - "isVisible": true - } - ], - "isVisible": true, - "name": "Basic Information", - "query": null, - "queryType": "", - "readOnly": false, - "type": "" - }, - { - "description": "", - "isVisible": true, - "name": "Custom Fields", - "query": null, - "queryType": "", - "readOnly": false, - "type": "" - } - ] - }, - "definitionId": "", - "description": "", - "detached": false, - "details": null, - "detailsV2": { - "TypeName": "", - "tabs": [ - { - "id": "summary", - "name": "Legacy Summary", - "type": "summary" - }, - { - "id": "caseinfoid", - "name": "Incident Info", - "sections": [ - { - "displayType": "ROW", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", - "isVisible": true, - "items": [ - { - "endCol": 2, - "fieldId": "alertid", - "height": 22, - "id": "b23cf510-a62a-11ed-85fd-253a4b8fc4fa", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "sekoiaalerturl", - "height": 22, - "id": "f6188ae0-aec4-11ed-b1b9-7d65758417e6", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "severity", - "height": 22, - "id": "incident-severity-field", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "owner", - "height": 22, - "id": "incident-owner-field", - "index": 3, - "sectionItemType": "field", - "startCol": 0 - }, - { - "dropEffect": "move", - "endCol": 2, - "fieldId": "alertcategory", - "height": 22, - "id": "2a4e39e0-a669-11ed-9ed8-a3cadf5e5136", - "index": 4, - "listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", - "sectionItemType": "field", - "startCol": 0 - }, - { - "dropEffect": "move", - "endCol": 2, - "fieldId": "alerttypeid", - "height": 22, - "id": "1cb738e0-a669-11ed-9ed8-a3cadf5e5136", - "index": 5, - "listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", - "sectionItemType": "field", - "startCol": 0 - }, - { - "dropEffect": "move", - "endCol": 2, - "fieldId": "type", - "height": 22, - "id": "incident-type-field", - "index": 6, - "listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "sourcebrand", - "height": 22, - "id": "incident-sourceBrand-field", - "index": 7, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "sourceinstance", - "height": 22, - "id": "incident-sourceInstance-field", - "index": 8, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "roles", - "height": 22, - "id": "647c0670-a0c3-11ed-a83a-21e09acc789a", - "index": 9, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "xsoarreadonlyroles", - "height": 22, - "id": "660a95b0-a0c3-11ed-a83a-21e09acc789a", - "index": 10, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "playbookid", - "height": 22, - "id": "incident-playbookId-field", - "index": 11, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Case Details", - "static": false, - "w": 1, - "x": 0, - "y": 0 - }, - { - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8", - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Notes", - "static": false, - "type": "notes", - "w": 1, - "x": 2, - "y": 0 - }, - { - "displayType": "ROW", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8", - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Work Plan", - "static": false, - "type": "workplan", - "w": 1, - "x": 1, - "y": 0 - }, - { - "displayType": "ROW", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-770ec200-98b1-11e9-97d7-ed26ef9e46c8", - "isVisible": true, - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Linked Incidents", - "static": false, - "type": "linkedIncidents", - "w": 1, - "x": 1, - "y": 6 - }, - { - "displayType": "ROW", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-842632c0-98b1-11e9-97d7-ed26ef9e46c8", - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Child Incidents", - "static": false, - "type": "childInv", - "w": 1, - "x": 1, - "y": 8 - }, - { - "displayType": "ROW", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-4a31afa0-98ba-11e9-a519-93a53c759fe0", - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Evidence", - "static": false, - "type": "evidence", - "w": 1, - "x": 2, - "y": 6 - }, - { - "displayType": "ROW", - "h": 2, - "hideName": false, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-7717e580-9bed-11e9-9a3f-8b4b2158e260", - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Team Members", - "static": false, - "type": "team", - "w": 1, - "x": 2, - "y": 8 - }, - { - "columns": [ - { - "displayed": true, - "isDefault": true, - "key": "indicator_type", - "width": 120 - }, - { - "displayed": true, - "isDefault": true, - "key": "value", - "width": 300 - }, - { - "displayed": true, - "isDefault": true, - "key": "score", - "width": 120 - }, - { - "displayed": true, - "isDefault": true, - "key": "firstSeen", - "width": 275 - }, - { - "displayed": true, - "isDefault": true, - "key": "lastSeen", - "width": 275 - }, - { - "displayed": true, - "isDefault": true, - "key": "timestamp", - "width": 190 - }, - { - "displayed": true, - "isDefault": true, - "key": "relatedIncCount", - "width": 150 - }, - { - "displayed": true, - "isDefault": true, - "key": "sourceBrands", - "width": 175 - }, - { - "displayed": true, - "isDefault": true, - "key": "sourceInstances", - "width": 175 - }, - { - "displayed": true, - "isDefault": true, - "key": "expirationStatus", - "width": 175 - }, - { - "displayed": true, - "isDefault": true, - "key": "expiration", - "width": 190 - } - ], - "displayType": "ROW", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-7ce69dd0-a07f-11e9-936c-5395a1acf11e", - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Indicators", - "query": "", - "queryType": "input", - "static": false, - "type": "indicators", - "w": 3, - "x": 0, - "y": 4 - }, - { - "displayType": "CARD", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", - "items": [ - { - "endCol": 1, - "fieldId": "occurred", - "height": 53, - "id": "incident-occurred-field", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 1, - "fieldId": "dbotmodified", - "height": 53, - "id": "incident-modified-field", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 1, - "fieldId": "dbotduedate", - "height": 53, - "id": "incident-dueDate-field", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "dbotcreated", - "height": 53, - "id": "incident-created-field", - "index": 0, - "sectionItemType": "field", - "startCol": 1 - }, - { - "endCol": 2, - "fieldId": "dbotclosed", - "height": 53, - "id": "incident-closed-field", - "index": 1, - "sectionItemType": "field", - "startCol": 1 - }, - { - "dropEffect": "move", - "endCol": 2, - "fieldId": "sourcecreatetime", - "height": 53, - "id": "dbea2c00-a668-11ed-9ed8-a3cadf5e5136", - "index": 4, - "listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", - "sectionItemType": "field", - "startCol": 1 - } - ], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Timeline Information", - "static": false, - "w": 1, - "x": 0, - "y": 2 - }, - { - "displayType": "CARD", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289", - "isVisible": true, - "items": [ - { - "endCol": 2, - "fieldId": "dbotclosed", - "height": 22, - "id": "incident-dbotClosed-field", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "closereason", - "height": 22, - "id": "incident-closeReason-field", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "closenotes", - "height": 44, - "id": "incident-closeNotes-field", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "dropEffect": "move", - "endCol": 2, - "fieldId": "test3", - "height": 22, - "id": "95c377c0-e369-11ed-aedc-2d5fb13bc893", - "index": 3, - "listId": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289", - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "test", - "height": 106, - "id": "01fda1a0-e2c4-11ed-bafc-0bdcc4fb33f5", - "index": 4, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Closing Information", - "static": false, - "w": 1, - "x": 0, - "y": 6 - }, - { - "displayType": "CARD", - "h": 2, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-e54b1770-a0b1-11e9-b27f-13ae1773d289", - "isVisible": true, - "items": [ - { - "endCol": 2, - "fieldId": "details", - "height": 106, - "id": "incident-details-field", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Investigation Data", - "static": false, - "w": 1, - "x": 1, - "y": 2 - }, - { - "displayType": "ROW", - "h": 2, - "hideName": false, - "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-79249190-a669-11ed-9ed8-a3cadf5e5136", - "items": [ - { - "endCol": 2, - "fieldId": "alertsource", - "height": 22, - "id": "a7d27d40-a669-11ed-9ed8-a3cadf5e5136", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "target", - "height": 22, - "id": "b24ad920-a669-11ed-9ed8-a3cadf5e5136", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "description", - "height": 22, - "id": "ad2d7dd0-a669-11ed-9ed8-a3cadf5e5136", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "test1", - "height": 22, - "id": "aabe9360-a85b-11ed-8334-3d4cde34d2d4", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Details", - "static": false, - "w": 1, - "x": 2, - "y": 2 - } - ], - "type": "custom" - }, - { - "hidden": false, - "id": "xwqxiqdriy", - "name": "Sekoia Alert", - "sections": [ - { - "h": 5, - "hideName": false, - "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-7bde8760-a95c-11ed-9145-25ddf42500b6", - "items": [], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Comments", - "query": "146130dc-9f3a-41e9-8a81-fbea9b933d0c", - "queryType": "script", - "static": false, - "type": "dynamic", - "w": 3, - "x": 0, - "y": 6 - }, - { - "displayType": "ROW", - "h": 3, - "hideName": false, - "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-7ece0630-a95c-11ed-9145-25ddf42500b6", - "items": [ - { - "endCol": 2, - "fieldId": "alertid", - "height": 22, - "id": "907fe6a0-a95c-11ed-9145-25ddf42500b6", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "dropEffect": "move", - "endCol": 2, - "fieldId": "sekoiaalerturl", - "height": 22, - "id": "99c31de0-a95c-11ed-9145-25ddf42500b6", - "index": 1, - "listId": "caseinfoid-7ece0630-a95c-11ed-9145-25ddf42500b6", - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "alertcategory", - "height": 22, - "id": "a884bc30-a95c-11ed-9145-25ddf42500b6", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "alerttypeid", - "height": 22, - "id": "ab392dd0-a95c-11ed-9145-25ddf42500b6", - "index": 3, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "sourcecreatetime", - "height": 22, - "id": "bb027820-a95c-11ed-9145-25ddf42500b6", - "index": 4, - "sectionItemType": "field", - "startCol": 0 - }, - { - "dropEffect": "move", - "endCol": 2, - "fieldId": "sekoiaalertstatus", - "height": 22, - "id": "a3e43c80-d3a2-11ed-a53e-9fbb99147542", - "index": 5, - "listId": "caseinfoid-7ece0630-a95c-11ed-9145-25ddf42500b6", - "sectionItemType": "field", - "startCol": 0 - }, - { - "args": { - "comment": { - "simple": "", - "userMarkedRequired": true - }, - "short_id": { - "complex": { - "accessor": "alertid", - "filters": [], - "root": "incident", - "transformers": [] - } - } - }, - "buttonClass": "primary", - "dropEffect": "move", - "endCol": 2, - "fieldId": "", - "height": 44, - "id": "58473820-dd09-11ed-8e0f-4badd587f193", - "index": 6, - "listId": "caseinfoid-xwqxiqdriy-caseinfoid-7ece0630-a95c-11ed-9145-25ddf42500b6", - "name": "UPDATE STATUS", - "scriptId": "b4e28711-18ee-4ae4-8ccb-1c5f647b55f1", - "sectionItemType": "button", - "startCol": 0 - }, - { - "args": { - "short_id": { - "complex": { - "accessor": "alertid", - "filters": [], - "root": "incident", - "transformers": [] - } - } - }, - "buttonClass": "success", - "endCol": 2, - "fieldId": "", - "height": 44, - "id": "ef9d3e80-ce87-11ed-81c5-57f992291288", - "index": 7, - "name": "ADD COMMENT", - "scriptId": "c82c5535-89e8-48a6-829b-05929bd88f8e", - "sectionItemType": "button", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Alert information", - "static": false, - "w": 1, - "x": 0, - "y": 0 - }, - { - "displayType": "ROW", - "h": 6, - "hideItemTitleOnlyOne": true, - "hideName": false, - "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-06bcc2c0-a95d-11ed-9145-25ddf42500b6", - "items": [ - { - "endCol": 2, - "fieldId": "sekoiaalertdetails", - "height": 106, - "id": "45a64580-d381-11ed-a53d-9fbb99147542", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Details", - "static": false, - "w": 1, - "x": 1, - "y": 0 - }, - { - "h": 2, - "hideName": false, - "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-c0be8e90-ac48-11ed-bd2d-994e9b5e36b1", - "items": [], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Case Information", - "query": "37b383c0-16a2-4962-8f46-7245f8e187a0", - "queryType": "script", - "static": false, - "type": "dynamic", - "w": 1, - "x": 2, - "y": 0 - }, - { - "displayType": "ROW", - "h": 3, - "hideItemTitleOnlyOne": true, - "hideName": false, - "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-ccc1c7d0-d848-11ed-a2c5-afbbb72993fe", - "items": [ - { - "endCol": 2, - "fieldId": "sekoiakillchain", - "height": 22, - "id": "d4996120-d848-11ed-a2c5-afbbb72993fe", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Kill Chain", - "static": false, - "w": 1, - "x": 0, - "y": 3 - }, - { - "h": 4, - "hideName": true, - "i": "xwqxiqdriy-308b91c0-3d3c-11ef-bbb1-2b336ca0953c", - "items": [], - "maxW": 3, - "minH": 1, - "moved": false, - "name": "Impacted assets", - "query": "13fe424a-a6dd-4b0a-8c60-7701d82a0ebc", - "queryType": "script", - "static": false, - "type": "dynamic", - "w": 1, - "x": 2, - "y": 2 - } - ], - "type": "custom" - }, - { - "id": "warRoom", - "name": "War Room", - "type": "warRoom" - }, - { - "id": "workPlan", - "name": "Work Plan", - "type": "workPlan" - }, - { - "id": "evidenceBoard", - "name": "Evidence Board", - "type": "evidenceBoard" - }, - { - "id": "relatedIncidents", - "name": "Related Incidents", - "type": "relatedIncidents" - }, - { - "id": "canvas", - "name": "Canvas", - "type": "canvas" - } - ] - }, - "edit": { - "sections": [ - { - "description": "", - "fields": [ - { - "fieldId": "incident_name", - "isVisible": true - }, - { - "fieldId": "incident_occurred", - "isVisible": true - }, - { - "fieldId": "incident_reminder", - "isVisible": true - }, - { - "fieldId": "incident_owner", - "isVisible": true - }, - { - "fieldId": "incident_roles", - "isVisible": true - }, - { - "fieldId": "incident_type", - "isVisible": true - }, - { - "fieldId": "incident_severity", - "isVisible": true - }, - { - "fieldId": "incident_playbookid", - "isVisible": true - }, - { - "fieldId": "incident_labels", - "isVisible": true - }, - { - "fieldId": "incident_phase", - "isVisible": true - }, - { - "fieldId": "incident_details", - "isVisible": true - }, - { - "fieldId": "incident_attachment", - "isVisible": true - } - ], - "isVisible": true, - "name": "Basic Information", - "query": null, - "queryType": "", - "readOnly": false, - "type": "" - }, - { - "description": "", - "fields": [ - { - "fieldId": "incident_asn", - "isVisible": true - }, - { - "fieldId": "incident_asnname", - "isVisible": true - }, - { - "fieldId": "incident_accountmemberof", - "isVisible": true - }, - { - "fieldId": "incident_accountstatus", - "isVisible": true - }, - { - "fieldId": "incident_additionaldata", - "isVisible": true - }, - { - "fieldId": "incident_additionalindicators", - "isVisible": true - }, - { - "fieldId": "incident_agentid", - "isVisible": true - }, - { - "fieldId": "incident_agentversion", - "isVisible": true - }, - { - "fieldId": "incident_agentsid", - "isVisible": true - }, - { - "fieldId": "incident_alertcategory", - "isVisible": true - }, - { - "fieldId": "incident_alertid", - "isVisible": true - }, - { - "fieldId": "incident_alertname", - "isVisible": true - }, - { - "fieldId": "incident_alertsource", - "isVisible": true - }, - { - "fieldId": "incident_alerttypeid", - "isVisible": true - }, - { - "fieldId": "incident_alerturl", - "isVisible": true - }, - { - "fieldId": "incident_app", - "isVisible": true - }, - { - "fieldId": "incident_appmessage", - "isVisible": true - }, - { - "fieldId": "incident_assigneduser", - "isVisible": true - }, - { - "fieldId": "incident_assignmentgroup", - "isVisible": true - }, - { - "fieldId": "incident_birthday", - "isVisible": true - }, - { - "fieldId": "incident_cmd", - "isVisible": true - }, - { - "fieldId": "incident_cmdline", - "isVisible": true - }, - { - "fieldId": "incident_cvelist", - "isVisible": true - }, - { - "fieldId": "incident_caller", - "isVisible": true - }, - { - "fieldId": "incident_categories", - "isVisible": true - }, - { - "fieldId": "incident_changed", - "isVisible": true - }, - { - "fieldId": "incident_childprocess", - "isVisible": true - }, - { - "fieldId": "incident_classification", - "isVisible": true - }, - { - "fieldId": "incident_cloudaccountid", - "isVisible": true - }, - { - "fieldId": "incident_cloudinstanceid", - "isVisible": true - }, - { - "fieldId": "incident_commandline", - "isVisible": true - }, - { - "fieldId": "incident_comment", - "isVisible": true - }, - { - "fieldId": "incident_country", - "isVisible": true - }, - { - "fieldId": "incident_countrycode", - "isVisible": true - }, - { - "fieldId": "incident_countrycodenumber", - "isVisible": true - }, - { - "fieldId": "incident_description", - "isVisible": true - }, - { - "fieldId": "incident_destinationhostname", - "isVisible": true - }, - { - "fieldId": "incident_destinationip", - "isVisible": true - }, - { - "fieldId": "incident_destinationnetwork", - "isVisible": true - }, - { - "fieldId": "incident_destinationnetworks", - "isVisible": true - }, - { - "fieldId": "incident_destinationport", - "isVisible": true - }, - { - "fieldId": "incident_detectedendpoints", - "isVisible": true - }, - { - "fieldId": "incident_detectedips", - "isVisible": true - }, - { - "fieldId": "incident_detecteduser", - "isVisible": true - }, - { - "fieldId": "incident_detectionurl", - "isVisible": true - }, - { - "fieldId": "incident_deviceexternalip", - "isVisible": true - }, - { - "fieldId": "incident_deviceexternalips", - "isVisible": true - }, - { - "fieldId": "incident_devicehash", - "isVisible": true - }, - { - "fieldId": "incident_deviceid", - "isVisible": true - }, - { - "fieldId": "incident_deviceinternalips", - "isVisible": true - }, - { - "fieldId": "incident_devicelocalip", - "isVisible": true - }, - { - "fieldId": "incident_devicemacaddress", - "isVisible": true - }, - { - "fieldId": "incident_devicemodel", - "isVisible": true - }, - { - "fieldId": "incident_devicename", - "isVisible": true - }, - { - "fieldId": "incident_deviceosname", - "isVisible": true - }, - { - "fieldId": "incident_deviceosversion", - "isVisible": true - }, - { - "fieldId": "incident_deviceou", - "isVisible": true - }, - { - "fieldId": "incident_deviceusername", - "isVisible": true - }, - { - "fieldId": "incident_domainname", - "isVisible": true - }, - { - "fieldId": "incident_dsts", - "isVisible": true - }, - { - "fieldId": "incident_endpoint", - "isVisible": true - }, - { - "fieldId": "incident_endpointisolationstatus", - "isVisible": true - }, - { - "fieldId": "incident_escalation", - "isVisible": true - }, - { - "fieldId": "incident_eventid", - "isVisible": true - }, - { - "fieldId": "incident_eventtype", - "isVisible": true - }, - { - "fieldId": "incident_events", - "isVisible": true - }, - { - "fieldId": "incident_externalcategoryid", - "isVisible": true - }, - { - "fieldId": "incident_externalcategoryname", - "isVisible": true - }, - { - "fieldId": "incident_externalconfidence", - "isVisible": true - }, - { - "fieldId": "incident_externalendtime", - "isVisible": true - }, - { - "fieldId": "incident_externallink", - "isVisible": true - }, - { - "fieldId": "incident_externalseverity", - "isVisible": true - }, - { - "fieldId": "incident_externalstarttime", - "isVisible": true - }, - { - "fieldId": "incident_externalstatus", - "isVisible": true - }, - { - "fieldId": "incident_externalsubcategoryid", - "isVisible": true - }, - { - "fieldId": "incident_externalsubcategoryname", - "isVisible": true - }, - { - "fieldId": "incident_externalsystemid", - "isVisible": true - }, - { - "fieldId": "incident_filehash", - "isVisible": true - }, - { - "fieldId": "incident_filemd5", - "isVisible": true - }, - { - "fieldId": "incident_filename", - "isVisible": true - }, - { - "fieldId": "incident_filenames", - "isVisible": true - }, - { - "fieldId": "incident_filepath", - "isVisible": true - }, - { - "fieldId": "incident_filepaths", - "isVisible": true - }, - { - "fieldId": "incident_filerelationships", - "isVisible": true - }, - { - "fieldId": "incident_filesha1", - "isVisible": true - }, - { - "fieldId": "incident_filesha256", - "isVisible": true - }, - { - "fieldId": "incident_filesize", - "isVisible": true - }, - { - "fieldId": "incident_fileupload", - "isVisible": true - }, - { - "fieldId": "incident_firstname", - "isVisible": true - }, - { - "fieldId": "incident_fullname", - "isVisible": true - }, - { - "fieldId": "incident_hostnames", - "isVisible": true - }, - { - "fieldId": "incident_huntresultscount", - "isVisible": true - }, - { - "fieldId": "incident_ipblockedstatus", - "isVisible": true - }, - { - "fieldId": "incident_ipreputation", - "isVisible": true - }, - { - "fieldId": "incident_incidentlink", - "isVisible": true - }, - { - "fieldId": "incident_incomingmirrorerror", - "isVisible": true - }, - { - "fieldId": "incident_investigationstage", - "isVisible": true - }, - { - "fieldId": "incident_isactive", - "isVisible": true - }, - { - "fieldId": "incident_lastname", - "isVisible": true - }, - { - "fieldId": "incident_logsource", - "isVisible": true - }, - { - "fieldId": "incident_lowlevelcategoriesevents", - "isVisible": true - }, - { - "fieldId": "incident_macaddress", - "isVisible": true - }, - { - "fieldId": "incident_md5", - "isVisible": true - }, - { - "fieldId": "incident_mitretacticid", - "isVisible": true - }, - { - "fieldId": "incident_mitretacticname", - "isVisible": true - }, - { - "fieldId": "incident_mitretechniqueid", - "isVisible": true - }, - { - "fieldId": "incident_mitretechniquename", - "isVisible": true - }, - { - "fieldId": "incident_mobiledevicemodel", - "isVisible": true - }, - { - "fieldId": "incident_numberofrelatedincidents", - "isVisible": true - }, - { - "fieldId": "incident_numberofsimilarfiles", - "isVisible": true - }, - { - "fieldId": "incident_os", - "isVisible": true - }, - { - "fieldId": "incident_ostype", - "isVisible": true - }, - { - "fieldId": "incident_osversion", - "isVisible": true - }, - { - "fieldId": "incident_objective", - "isVisible": true - }, - { - "fieldId": "incident_orglevel1", - "isVisible": true - }, - { - "fieldId": "incident_orglevel2", - "isVisible": true - }, - { - "fieldId": "incident_orglevel3", - "isVisible": true - }, - { - "fieldId": "incident_orgunit", - "isVisible": true - }, - { - "fieldId": "incident_outgoingmirrorerror", - "isVisible": true - }, - { - "fieldId": "incident_pid", - "isVisible": true - }, - { - "fieldId": "incident_parentcmdline", - "isVisible": true - }, - { - "fieldId": "incident_parentprocess", - "isVisible": true - }, - { - "fieldId": "incident_parentprocesscmd", - "isVisible": true - }, - { - "fieldId": "incident_parentprocessfilepath", - "isVisible": true - }, - { - "fieldId": "incident_parentprocessids", - "isVisible": true - }, - { - "fieldId": "incident_parentprocessmd5", - "isVisible": true - }, - { - "fieldId": "incident_parentprocessname", - "isVisible": true - }, - { - "fieldId": "incident_parentprocesspath", - "isVisible": true - }, - { - "fieldId": "incident_parentprocesssha256", - "isVisible": true - }, - { - "fieldId": "incident_passwordchangeddate", - "isVisible": true - }, - { - "fieldId": "incident_phonenumber", - "isVisible": true - }, - { - "fieldId": "incident_policyactions", - "isVisible": true - }, - { - "fieldId": "incident_processcmd", - "isVisible": true - }, - { - "fieldId": "incident_processcreationtime", - "isVisible": true - }, - { - "fieldId": "incident_processid", - "isVisible": true - }, - { - "fieldId": "incident_processmd5", - "isVisible": true - }, - { - "fieldId": "incident_processname", - "isVisible": true - }, - { - "fieldId": "incident_processnames", - "isVisible": true - }, - { - "fieldId": "incident_processpath", - "isVisible": true - }, - { - "fieldId": "incident_processpaths", - "isVisible": true - }, - { - "fieldId": "incident_processsha256", - "isVisible": true - }, - { - "fieldId": "incident_protocol", - "isVisible": true - }, - { - "fieldId": "incident_protocolnames", - "isVisible": true - }, - { - "fieldId": "incident_registryhive", - "isVisible": true - }, - { - "fieldId": "incident_registrykey", - "isVisible": true - }, - { - "fieldId": "incident_registryvalue", - "isVisible": true - }, - { - "fieldId": "incident_registryvaluetype", - "isVisible": true - }, - { - "fieldId": "incident_relatedendpoints", - "isVisible": true - }, - { - "fieldId": "incident_relatedreport", - "isVisible": true - }, - { - "fieldId": "incident_renderedhtml", - "isVisible": true - }, - { - "fieldId": "incident_rulename", - "isVisible": true - }, - { - "fieldId": "incident_sha1", - "isVisible": true - }, - { - "fieldId": "incident_sha256", - "isVisible": true - }, - { - "fieldId": "incident_sha512", - "isVisible": true - }, - { - "fieldId": "incident_ssdeep", - "isVisible": true - }, - { - "fieldId": "incident_scenario", - "isVisible": true - }, - { - "fieldId": "incident_sekoiaalertdetails", - "isVisible": true - }, - { - "fieldId": "incident_sekoiaalertstatus", - "isVisible": true - }, - { - "fieldId": "incident_sekoiaevents", - "isVisible": true - }, - { - "fieldId": "incident_sekoiakillchain", - "isVisible": true - }, - { - "fieldId": "incident_selectedindicators", - "isVisible": true - }, - { - "fieldId": "incident_similarincidentsdbot", - "isVisible": true - }, - { - "fieldId": "incident_sourcecategory", - "isVisible": true - }, - { - "fieldId": "incident_sourcecreatetime", - "isVisible": true - }, - { - "fieldId": "incident_sourcecreatedby", - "isVisible": true - }, - { - "fieldId": "incident_sourceexternalips", - "isVisible": true - }, - { - "fieldId": "incident_sourcehostname", - "isVisible": true - }, - { - "fieldId": "incident_sourceip", - "isVisible": true - }, - { - "fieldId": "incident_sourceid", - "isVisible": true - }, - { - "fieldId": "incident_sourcenetwork", - "isVisible": true - }, - { - "fieldId": "incident_sourcenetworks", - "isVisible": true - }, - { - "fieldId": "incident_sourceport", - "isVisible": true - }, - { - "fieldId": "incident_sourcepriority", - "isVisible": true - }, - { - "fieldId": "incident_sourcestatus", - "isVisible": true - }, - { - "fieldId": "incident_sourceupdatedby", - "isVisible": true - }, - { - "fieldId": "incident_sourceusername", - "isVisible": true - }, - { - "fieldId": "incident_srcs", - "isVisible": true - }, - { - "fieldId": "incident_state", - "isVisible": true - }, - { - "fieldId": "incident_subcategory", - "isVisible": true - }, - { - "fieldId": "incident_tactic", - "isVisible": true - }, - { - "fieldId": "incident_tacticid", - "isVisible": true - }, - { - "fieldId": "incident_tags", - "isVisible": true - }, - { - "fieldId": "incident_target", - "isVisible": true - }, - { - "fieldId": "incident_teamname", - "isVisible": true - }, - { - "fieldId": "incident_technique", - "isVisible": true - }, - { - "fieldId": "incident_techniqueid", - "isVisible": true - }, - { - "fieldId": "incident_tenantname", - "isVisible": true - }, - { - "fieldId": "incident_threatfamilyname", - "isVisible": true - }, - { - "fieldId": "incident_threathuntingdetectedhostnames", - "isVisible": true - }, - { - "fieldId": "incident_threathuntingdetectedip", - "isVisible": true - }, - { - "fieldId": "incident_threatname", - "isVisible": true - }, - { - "fieldId": "incident_ticketacknowledgeddate", - "isVisible": true - }, - { - "fieldId": "incident_ticketcloseddate", - "isVisible": true - }, - { - "fieldId": "incident_ticketnumber", - "isVisible": true - }, - { - "fieldId": "incident_ticketopeneddate", - "isVisible": true - }, - { - "fieldId": "incident_urlsslverification", - "isVisible": true - }, - { - "fieldId": "incident_urls", - "isVisible": true - }, - { - "fieldId": "incident_usecasedescription", - "isVisible": true - }, - { - "fieldId": "incident_usercreationtime", - "isVisible": true - }, - { - "fieldId": "incident_userengagementresponse", - "isVisible": true - }, - { - "fieldId": "incident_usersid", - "isVisible": true - }, - { - "fieldId": "incident_users", - "isVisible": true - }, - { - "fieldId": "incident_verdict", - "isVisible": true - }, - { - "fieldId": "incident_appchannelname", - "isVisible": true - }, - { - "fieldId": "incident_similarincidents", - "isVisible": true - }, - { - "fieldId": "incident_useraccountcontrol", - "isVisible": true - } - ], - "isVisible": true, - "name": "Custom Fields", - "query": null, - "queryType": "", - "readOnly": false, - "type": "" - } - ] - }, - "fromServerVersion": "", - "group": "incident", - "id": "Sekoia XDR Layout", - "indicatorsDetails": null, - "indicatorsQuickView": null, - "itemVersion": "", - "locked": false, - "mobile": null, - "name": "Sekoia XDR Layout", - "packID": "", - "packName": "", - "propagationLabels": [ - "all" - ], - "quickView": null, - "quickViewV2": null, - "system": false, - "toServerVersion": "", - "version": -1, - "fromVersion": "6.10.0" + "close": { + "sections": [ + { + "description": "", + "fields": [ + { + "fieldId": "incident_sekoiaalertreject", + "isVisible": true + }, + { + "fieldId": "incident_closereason", + "isVisible": true + }, + { + "fieldId": "incident_closenotes", + "isVisible": true + }, + { + "fieldId": "incident_owner", + "isVisible": true + } + ], + "isVisible": true, + "name": "Basic Information", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "isVisible": true, + "name": "Custom Fields", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + } + ] + }, + "detailsV2": { + "tabs": [ + { + "id": "summary", + "name": "Legacy Summary", + "type": "summary" + }, + { + "id": "caseinfoid", + "name": "Incident Info", + "sections": [ + { + "displayType": "ROW", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", + "isVisible": true, + "items": [ + { + "endCol": 2, + "fieldId": "alertid", + "height": 22, + "id": "b23cf510-a62a-11ed-85fd-253a4b8fc4fa", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "severity", + "height": 22, + "id": "incident-severity-field", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "owner", + "height": 22, + "id": "incident-owner-field", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "dropEffect": "move", + "endCol": 2, + "fieldId": "alertcategory", + "height": 22, + "id": "2a4e39e0-a669-11ed-9ed8-a3cadf5e5136", + "index": 4, + "listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", + "sectionItemType": "field", + "startCol": 0 + }, + { + "dropEffect": "move", + "endCol": 2, + "fieldId": "alerttypeid", + "height": 22, + "id": "1cb738e0-a669-11ed-9ed8-a3cadf5e5136", + "index": 5, + "listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", + "sectionItemType": "field", + "startCol": 0 + }, + { + "dropEffect": "move", + "endCol": 2, + "fieldId": "type", + "height": 22, + "id": "incident-type-field", + "index": 6, + "listId": "caseinfoid-fce71720-98b0-11e9-97d7-ed26ef9e46c8", + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "sourcebrand", + "height": 22, + "id": "incident-sourceBrand-field", + "index": 7, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "sourceinstance", + "height": 22, + "id": "incident-sourceInstance-field", + "index": 8, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "roles", + "height": 22, + "id": "647c0670-a0c3-11ed-a83a-21e09acc789a", + "index": 9, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "xsoarreadonlyroles", + "height": 22, + "id": "660a95b0-a0c3-11ed-a83a-21e09acc789a", + "index": 10, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "playbookid", + "height": 22, + "id": "incident-playbookId-field", + "index": 11, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Case Details", + "static": false, + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-61263cc0-98b1-11e9-97d7-ed26ef9e46c8", + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Notes", + "static": false, + "type": "notes", + "w": 1, + "x": 2, + "y": 0 + }, + { + "displayType": "ROW", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-6aabad20-98b1-11e9-97d7-ed26ef9e46c8", + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Work Plan", + "static": false, + "type": "workplan", + "w": 1, + "x": 1, + "y": 0 + }, + { + "displayType": "ROW", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-770ec200-98b1-11e9-97d7-ed26ef9e46c8", + "isVisible": true, + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Linked Incidents", + "static": false, + "type": "linkedIncidents", + "w": 1, + "x": 1, + "y": 6 + }, + { + "displayType": "ROW", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-842632c0-98b1-11e9-97d7-ed26ef9e46c8", + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Child Incidents", + "static": false, + "type": "childInv", + "w": 1, + "x": 1, + "y": 8 + }, + { + "displayType": "ROW", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-4a31afa0-98ba-11e9-a519-93a53c759fe0", + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Evidence", + "static": false, + "type": "evidence", + "w": 1, + "x": 2, + "y": 6 + }, + { + "displayType": "ROW", + "h": 2, + "hideName": false, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-7717e580-9bed-11e9-9a3f-8b4b2158e260", + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Team Members", + "static": false, + "type": "team", + "w": 1, + "x": 2, + "y": 8 + }, + { + "columns": [ + { + "displayed": true, + "isDefault": true, + "key": "indicator_type", + "width": 120 + }, + { + "displayed": true, + "isDefault": true, + "key": "value", + "width": 300 + }, + { + "displayed": true, + "isDefault": true, + "key": "score", + "width": 120 + }, + { + "displayed": true, + "isDefault": true, + "key": "firstSeen", + "width": 275 + }, + { + "displayed": true, + "isDefault": true, + "key": "lastSeen", + "width": 275 + }, + { + "displayed": true, + "isDefault": true, + "key": "timestamp", + "width": 190 + }, + { + "displayed": true, + "isDefault": true, + "key": "relatedIncCount", + "width": 150 + }, + { + "displayed": true, + "isDefault": true, + "key": "sourceBrands", + "width": 175 + }, + { + "displayed": true, + "isDefault": true, + "key": "sourceInstances", + "width": 175 + }, + { + "displayed": true, + "isDefault": true, + "key": "expirationStatus", + "width": 175 + }, + { + "displayed": true, + "isDefault": true, + "key": "expiration", + "width": 190 + } + ], + "displayType": "ROW", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-7ce69dd0-a07f-11e9-936c-5395a1acf11e", + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Indicators", + "query": "", + "queryType": "input", + "static": false, + "type": "indicators", + "w": 3, + "x": 0, + "y": 4 + }, + { + "displayType": "CARD", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", + "items": [ + { + "endCol": 1, + "fieldId": "occurred", + "height": 53, + "id": "incident-occurred-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 1, + "fieldId": "dbotmodified", + "height": 53, + "id": "incident-modified-field", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 1, + "fieldId": "dbotduedate", + "height": 53, + "id": "incident-dueDate-field", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "dbotcreated", + "height": 53, + "id": "incident-created-field", + "index": 0, + "sectionItemType": "field", + "startCol": 1 + }, + { + "endCol": 2, + "fieldId": "dbotclosed", + "height": 53, + "id": "incident-closed-field", + "index": 1, + "sectionItemType": "field", + "startCol": 1 + }, + { + "dropEffect": "move", + "endCol": 2, + "fieldId": "sourcecreatetime", + "height": 53, + "id": "dbea2c00-a668-11ed-9ed8-a3cadf5e5136", + "index": 4, + "listId": "caseinfoid-ac32f620-a0b0-11e9-b27f-13ae1773d289", + "sectionItemType": "field", + "startCol": 1 + } + ], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Timeline Information", + "static": false, + "w": 1, + "x": 0, + "y": 2 + }, + { + "displayType": "CARD", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-88e6bf70-a0b1-11e9-b27f-13ae1773d289", + "isVisible": true, + "items": [ + { + "endCol": 2, + "fieldId": "dbotclosed", + "height": 22, + "id": "incident-dbotClosed-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "closereason", + "height": 22, + "id": "incident-closeReason-field", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "closenotes", + "height": 44, + "id": "incident-closeNotes-field", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Closing Information", + "static": false, + "w": 1, + "x": 0, + "y": 6 + }, + { + "displayType": "CARD", + "h": 2, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-e54b1770-a0b1-11e9-b27f-13ae1773d289", + "isVisible": true, + "items": [ + { + "endCol": 2, + "fieldId": "details", + "height": 106, + "id": "incident-details-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Investigation Data", + "static": false, + "w": 1, + "x": 1, + "y": 2 + }, + { + "displayType": "ROW", + "h": 2, + "hideName": false, + "i": "caseinfoid-field-changed-caseinfoid-hmim4odmnc-caseinfoid-79249190-a669-11ed-9ed8-a3cadf5e5136", + "items": [ + { + "endCol": 2, + "fieldId": "alertsource", + "height": 22, + "id": "a7d27d40-a669-11ed-9ed8-a3cadf5e5136", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "target", + "height": 22, + "id": "b24ad920-a669-11ed-9ed8-a3cadf5e5136", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "description", + "height": 22, + "id": "ad2d7dd0-a669-11ed-9ed8-a3cadf5e5136", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Details", + "static": false, + "w": 1, + "x": 2, + "y": 2 + } + ], + "type": "custom" + }, + { + "hidden": false, + "id": "xwqxiqdriy", + "name": "Sekoia Alert", + "sections": [ + { + "h": 5, + "hideName": false, + "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-7bde8760-a95c-11ed-9145-25ddf42500b6", + "items": [], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Comments", + "query": "146130dc-9f3a-41e9-8a81-fbea9b933d0c", + "queryType": "script", + "static": false, + "type": "dynamic", + "w": 3, + "x": 0, + "y": 6 + }, + { + "displayType": "ROW", + "h": 3, + "hideName": false, + "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-7ece0630-a95c-11ed-9145-25ddf42500b6", + "items": [ + { + "endCol": 2, + "fieldId": "alertid", + "height": 22, + "id": "907fe6a0-a95c-11ed-9145-25ddf42500b6", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "alertcategory", + "height": 22, + "id": "a884bc30-a95c-11ed-9145-25ddf42500b6", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "alerttypeid", + "height": 22, + "id": "ab392dd0-a95c-11ed-9145-25ddf42500b6", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "sourcecreatetime", + "height": 22, + "id": "bb027820-a95c-11ed-9145-25ddf42500b6", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "dropEffect": "move", + "endCol": 2, + "fieldId": "sekoiaalertstatus", + "height": 22, + "id": "a3e43c80-d3a2-11ed-a53e-9fbb99147542", + "index": 5, + "listId": "caseinfoid-7ece0630-a95c-11ed-9145-25ddf42500b6", + "sectionItemType": "field", + "startCol": 0 + }, + { + "args": { + "comment": { + "simple": "", + "userMarkedRequired": true + }, + "short_id": { + "complex": { + "accessor": "alertid", + "filters": [], + "root": "incident", + "transformers": [] + } + } + }, + "buttonClass": "primary", + "dropEffect": "move", + "endCol": 2, + "fieldId": "", + "height": 44, + "id": "58473820-dd09-11ed-8e0f-4badd587f193", + "index": 6, + "listId": "caseinfoid-xwqxiqdriy-caseinfoid-7ece0630-a95c-11ed-9145-25ddf42500b6", + "name": "UPDATE STATUS", + "scriptId": "b4e28711-18ee-4ae4-8ccb-1c5f647b55f1", + "sectionItemType": "button", + "startCol": 0 + }, + { + "args": { + "short_id": { + "complex": { + "accessor": "alertid", + "filters": [], + "root": "incident", + "transformers": [] + } + } + }, + "buttonClass": "success", + "endCol": 2, + "fieldId": "", + "height": 44, + "id": "ef9d3e80-ce87-11ed-81c5-57f992291288", + "index": 7, + "name": "ADD COMMENT", + "scriptId": "c82c5535-89e8-48a6-829b-05929bd88f8e", + "sectionItemType": "button", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Alert information", + "static": false, + "w": 1, + "x": 0, + "y": 0 + }, + { + "displayType": "ROW", + "h": 6, + "hideItemTitleOnlyOne": true, + "hideName": false, + "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-06bcc2c0-a95d-11ed-9145-25ddf42500b6", + "items": [ + { + "endCol": 2, + "fieldId": "sekoiaalertdetails", + "height": 106, + "id": "45a64580-d381-11ed-a53d-9fbb99147542", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Details", + "static": false, + "w": 1, + "x": 1, + "y": 0 + }, + { + "h": 2, + "hideName": false, + "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-c0be8e90-ac48-11ed-bd2d-994e9b5e36b1", + "items": [], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Case Information", + "query": "37b383c0-16a2-4962-8f46-7245f8e187a0", + "queryType": "script", + "static": false, + "type": "dynamic", + "w": 1, + "x": 2, + "y": 0 + }, + { + "displayType": "ROW", + "h": 3, + "hideItemTitleOnlyOne": true, + "hideName": false, + "i": "xwqxiqdriy-caseinfoid-xwqxiqdriy-field-changed-xwqxiqdriy-caseinfoid-xwqxiqdriy-caseinfoid-ccc1c7d0-d848-11ed-a2c5-afbbb72993fe", + "items": [ + { + "endCol": 2, + "fieldId": "sekoiakillchain", + "height": 22, + "id": "d4996120-d848-11ed-a2c5-afbbb72993fe", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Kill Chain", + "static": false, + "w": 1, + "x": 0, + "y": 3 + }, + { + "h": 4, + "hideName": true, + "i": "xwqxiqdriy-308b91c0-3d3c-11ef-bbb1-2b336ca0953c", + "items": [], + "maxW": 3, + "minH": 1, + "moved": false, + "name": "Impacted assets", + "query": "13fe424a-a6dd-4b0a-8c60-7701d82a0ebc", + "queryType": "script", + "static": false, + "type": "dynamic", + "w": 1, + "x": 2, + "y": 2 + } + ], + "type": "custom" + }, + { + "id": "warRoom", + "name": "War Room", + "type": "warRoom" + }, + { + "id": "workPlan", + "name": "Work Plan", + "type": "workPlan" + }, + { + "id": "evidenceBoard", + "name": "Evidence Board", + "type": "evidenceBoard" + }, + { + "id": "relatedIncidents", + "name": "Related Incidents", + "type": "relatedIncidents" + }, + { + "id": "canvas", + "name": "Canvas", + "type": "canvas" + } + ] + }, + "edit": { + "sections": [ + { + "description": "", + "fields": [ + { + "fieldId": "incident_name", + "isVisible": true + }, + { + "fieldId": "incident_occurred", + "isVisible": true + }, + { + "fieldId": "incident_reminder", + "isVisible": true + }, + { + "fieldId": "incident_owner", + "isVisible": true + }, + { + "fieldId": "incident_roles", + "isVisible": true + }, + { + "fieldId": "incident_type", + "isVisible": true + }, + { + "fieldId": "incident_severity", + "isVisible": true + }, + { + "fieldId": "incident_playbookid", + "isVisible": true + }, + { + "fieldId": "incident_labels", + "isVisible": true + }, + { + "fieldId": "incident_phase", + "isVisible": true + }, + { + "fieldId": "incident_details", + "isVisible": true + }, + { + "fieldId": "incident_attachment", + "isVisible": true + } + ], + "isVisible": true, + "name": "Basic Information", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "incident_asn", + "isVisible": true + }, + { + "fieldId": "incident_asnname", + "isVisible": true + }, + { + "fieldId": "incident_accountmemberof", + "isVisible": true + }, + { + "fieldId": "incident_accountstatus", + "isVisible": true + }, + { + "fieldId": "incident_additionaldata", + "isVisible": true + }, + { + "fieldId": "incident_additionalindicators", + "isVisible": true + }, + { + "fieldId": "incident_agentid", + "isVisible": true + }, + { + "fieldId": "incident_agentversion", + "isVisible": true + }, + { + "fieldId": "incident_agentsid", + "isVisible": true + }, + { + "fieldId": "incident_alertcategory", + "isVisible": true + }, + { + "fieldId": "incident_alertid", + "isVisible": true + }, + { + "fieldId": "incident_alertname", + "isVisible": true + }, + { + "fieldId": "incident_alertsource", + "isVisible": true + }, + { + "fieldId": "incident_alerttypeid", + "isVisible": true + }, + { + "fieldId": "incident_alerturl", + "isVisible": true + }, + { + "fieldId": "incident_app", + "isVisible": true + }, + { + "fieldId": "incident_appmessage", + "isVisible": true + }, + { + "fieldId": "incident_assigneduser", + "isVisible": true + }, + { + "fieldId": "incident_assignmentgroup", + "isVisible": true + }, + { + "fieldId": "incident_birthday", + "isVisible": true + }, + { + "fieldId": "incident_cmd", + "isVisible": true + }, + { + "fieldId": "incident_cmdline", + "isVisible": true + }, + { + "fieldId": "incident_cvelist", + "isVisible": true + }, + { + "fieldId": "incident_caller", + "isVisible": true + }, + { + "fieldId": "incident_categories", + "isVisible": true + }, + { + "fieldId": "incident_changed", + "isVisible": true + }, + { + "fieldId": "incident_childprocess", + "isVisible": true + }, + { + "fieldId": "incident_classification", + "isVisible": true + }, + { + "fieldId": "incident_cloudaccountid", + "isVisible": true + }, + { + "fieldId": "incident_cloudinstanceid", + "isVisible": true + }, + { + "fieldId": "incident_commandline", + "isVisible": true + }, + { + "fieldId": "incident_comment", + "isVisible": true + }, + { + "fieldId": "incident_country", + "isVisible": true + }, + { + "fieldId": "incident_countrycode", + "isVisible": true + }, + { + "fieldId": "incident_countrycodenumber", + "isVisible": true + }, + { + "fieldId": "incident_description", + "isVisible": true + }, + { + "fieldId": "incident_destinationhostname", + "isVisible": true + }, + { + "fieldId": "incident_destinationip", + "isVisible": true + }, + { + "fieldId": "incident_destinationnetwork", + "isVisible": true + }, + { + "fieldId": "incident_destinationnetworks", + "isVisible": true + }, + { + "fieldId": "incident_destinationport", + "isVisible": true + }, + { + "fieldId": "incident_detectedendpoints", + "isVisible": true + }, + { + "fieldId": "incident_detectedips", + "isVisible": true + }, + { + "fieldId": "incident_detecteduser", + "isVisible": true + }, + { + "fieldId": "incident_detectionurl", + "isVisible": true + }, + { + "fieldId": "incident_deviceexternalip", + "isVisible": true + }, + { + "fieldId": "incident_deviceexternalips", + "isVisible": true + }, + { + "fieldId": "incident_devicehash", + "isVisible": true + }, + { + "fieldId": "incident_deviceid", + "isVisible": true + }, + { + "fieldId": "incident_deviceinternalips", + "isVisible": true + }, + { + "fieldId": "incident_devicelocalip", + "isVisible": true + }, + { + "fieldId": "incident_devicemacaddress", + "isVisible": true + }, + { + "fieldId": "incident_devicemodel", + "isVisible": true + }, + { + "fieldId": "incident_devicename", + "isVisible": true + }, + { + "fieldId": "incident_deviceosname", + "isVisible": true + }, + { + "fieldId": "incident_deviceosversion", + "isVisible": true + }, + { + "fieldId": "incident_deviceou", + "isVisible": true + }, + { + "fieldId": "incident_deviceusername", + "isVisible": true + }, + { + "fieldId": "incident_domainname", + "isVisible": true + }, + { + "fieldId": "incident_dsts", + "isVisible": true + }, + { + "fieldId": "incident_endpoint", + "isVisible": true + }, + { + "fieldId": "incident_endpointisolationstatus", + "isVisible": true + }, + { + "fieldId": "incident_escalation", + "isVisible": true + }, + { + "fieldId": "incident_eventid", + "isVisible": true + }, + { + "fieldId": "incident_eventtype", + "isVisible": true + }, + { + "fieldId": "incident_events", + "isVisible": true + }, + { + "fieldId": "incident_externalcategoryid", + "isVisible": true + }, + { + "fieldId": "incident_externalcategoryname", + "isVisible": true + }, + { + "fieldId": "incident_externalconfidence", + "isVisible": true + }, + { + "fieldId": "incident_externalendtime", + "isVisible": true + }, + { + "fieldId": "incident_externallink", + "isVisible": true + }, + { + "fieldId": "incident_externalseverity", + "isVisible": true + }, + { + "fieldId": "incident_externalstarttime", + "isVisible": true + }, + { + "fieldId": "incident_externalstatus", + "isVisible": true + }, + { + "fieldId": "incident_externalsubcategoryid", + "isVisible": true + }, + { + "fieldId": "incident_externalsubcategoryname", + "isVisible": true + }, + { + "fieldId": "incident_externalsystemid", + "isVisible": true + }, + { + "fieldId": "incident_filehash", + "isVisible": true + }, + { + "fieldId": "incident_filemd5", + "isVisible": true + }, + { + "fieldId": "incident_filename", + "isVisible": true + }, + { + "fieldId": "incident_filenames", + "isVisible": true + }, + { + "fieldId": "incident_filepath", + "isVisible": true + }, + { + "fieldId": "incident_filepaths", + "isVisible": true + }, + { + "fieldId": "incident_filerelationships", + "isVisible": true + }, + { + "fieldId": "incident_filesha1", + "isVisible": true + }, + { + "fieldId": "incident_filesha256", + "isVisible": true + }, + { + "fieldId": "incident_filesize", + "isVisible": true + }, + { + "fieldId": "incident_fileupload", + "isVisible": true + }, + { + "fieldId": "incident_firstname", + "isVisible": true + }, + { + "fieldId": "incident_fullname", + "isVisible": true + }, + { + "fieldId": "incident_hostnames", + "isVisible": true + }, + { + "fieldId": "incident_huntresultscount", + "isVisible": true + }, + { + "fieldId": "incident_ipblockedstatus", + "isVisible": true + }, + { + "fieldId": "incident_ipreputation", + "isVisible": true + }, + { + "fieldId": "incident_incidentlink", + "isVisible": true + }, + { + "fieldId": "incident_incomingmirrorerror", + "isVisible": true + }, + { + "fieldId": "incident_investigationstage", + "isVisible": true + }, + { + "fieldId": "incident_isactive", + "isVisible": true + }, + { + "fieldId": "incident_lastname", + "isVisible": true + }, + { + "fieldId": "incident_logsource", + "isVisible": true + }, + { + "fieldId": "incident_lowlevelcategoriesevents", + "isVisible": true + }, + { + "fieldId": "incident_macaddress", + "isVisible": true + }, + { + "fieldId": "incident_md5", + "isVisible": true + }, + { + "fieldId": "incident_mitretacticid", + "isVisible": true + }, + { + "fieldId": "incident_mitretacticname", + "isVisible": true + }, + { + "fieldId": "incident_mitretechniqueid", + "isVisible": true + }, + { + "fieldId": "incident_mitretechniquename", + "isVisible": true + }, + { + "fieldId": "incident_mobiledevicemodel", + "isVisible": true + }, + { + "fieldId": "incident_numberofrelatedincidents", + "isVisible": true + }, + { + "fieldId": "incident_numberofsimilarfiles", + "isVisible": true + }, + { + "fieldId": "incident_os", + "isVisible": true + }, + { + "fieldId": "incident_ostype", + "isVisible": true + }, + { + "fieldId": "incident_osversion", + "isVisible": true + }, + { + "fieldId": "incident_objective", + "isVisible": true + }, + { + "fieldId": "incident_orglevel1", + "isVisible": true + }, + { + "fieldId": "incident_orglevel2", + "isVisible": true + }, + { + "fieldId": "incident_orglevel3", + "isVisible": true + }, + { + "fieldId": "incident_orgunit", + "isVisible": true + }, + { + "fieldId": "incident_outgoingmirrorerror", + "isVisible": true + }, + { + "fieldId": "incident_pid", + "isVisible": true + }, + { + "fieldId": "incident_parentcmdline", + "isVisible": true + }, + { + "fieldId": "incident_parentprocess", + "isVisible": true + }, + { + "fieldId": "incident_parentprocesscmd", + "isVisible": true + }, + { + "fieldId": "incident_parentprocessfilepath", + "isVisible": true + }, + { + "fieldId": "incident_parentprocessids", + "isVisible": true + }, + { + "fieldId": "incident_parentprocessmd5", + "isVisible": true + }, + { + "fieldId": "incident_parentprocessname", + "isVisible": true + }, + { + "fieldId": "incident_parentprocesspath", + "isVisible": true + }, + { + "fieldId": "incident_parentprocesssha256", + "isVisible": true + }, + { + "fieldId": "incident_passwordchangeddate", + "isVisible": true + }, + { + "fieldId": "incident_phonenumber", + "isVisible": true + }, + { + "fieldId": "incident_policyactions", + "isVisible": true + }, + { + "fieldId": "incident_processcmd", + "isVisible": true + }, + { + "fieldId": "incident_processcreationtime", + "isVisible": true + }, + { + "fieldId": "incident_processid", + "isVisible": true + }, + { + "fieldId": "incident_processmd5", + "isVisible": true + }, + { + "fieldId": "incident_processname", + "isVisible": true + }, + { + "fieldId": "incident_processnames", + "isVisible": true + }, + { + "fieldId": "incident_processpath", + "isVisible": true + }, + { + "fieldId": "incident_processpaths", + "isVisible": true + }, + { + "fieldId": "incident_processsha256", + "isVisible": true + }, + { + "fieldId": "incident_protocol", + "isVisible": true + }, + { + "fieldId": "incident_protocolnames", + "isVisible": true + }, + { + "fieldId": "incident_registryhive", + "isVisible": true + }, + { + "fieldId": "incident_registrykey", + "isVisible": true + }, + { + "fieldId": "incident_registryvalue", + "isVisible": true + }, + { + "fieldId": "incident_registryvaluetype", + "isVisible": true + }, + { + "fieldId": "incident_relatedendpoints", + "isVisible": true + }, + { + "fieldId": "incident_relatedreport", + "isVisible": true + }, + { + "fieldId": "incident_renderedhtml", + "isVisible": true + }, + { + "fieldId": "incident_rulename", + "isVisible": true + }, + { + "fieldId": "incident_sha1", + "isVisible": true + }, + { + "fieldId": "incident_sha256", + "isVisible": true + }, + { + "fieldId": "incident_sha512", + "isVisible": true + }, + { + "fieldId": "incident_ssdeep", + "isVisible": true + }, + { + "fieldId": "incident_scenario", + "isVisible": true + }, + { + "fieldId": "incident_sekoiaalertdetails", + "isVisible": true + }, + { + "fieldId": "incident_sekoiaalertstatus", + "isVisible": true + }, + { + "fieldId": "incident_sekoiaevents", + "isVisible": true + }, + { + "fieldId": "incident_sekoiakillchain", + "isVisible": true + }, + { + "fieldId": "incident_selectedindicators", + "isVisible": true + }, + { + "fieldId": "incident_similarincidentsdbot", + "isVisible": true + }, + { + "fieldId": "incident_sourcecategory", + "isVisible": true + }, + { + "fieldId": "incident_sourcecreatetime", + "isVisible": true + }, + { + "fieldId": "incident_sourcecreatedby", + "isVisible": true + }, + { + "fieldId": "incident_sourceexternalips", + "isVisible": true + }, + { + "fieldId": "incident_sourcehostname", + "isVisible": true + }, + { + "fieldId": "incident_sourceip", + "isVisible": true + }, + { + "fieldId": "incident_sourceid", + "isVisible": true + }, + { + "fieldId": "incident_sourcenetwork", + "isVisible": true + }, + { + "fieldId": "incident_sourcenetworks", + "isVisible": true + }, + { + "fieldId": "incident_sourceport", + "isVisible": true + }, + { + "fieldId": "incident_sourcepriority", + "isVisible": true + }, + { + "fieldId": "incident_sourcestatus", + "isVisible": true + }, + { + "fieldId": "incident_sourceupdatedby", + "isVisible": true + }, + { + "fieldId": "incident_sourceusername", + "isVisible": true + }, + { + "fieldId": "incident_srcs", + "isVisible": true + }, + { + "fieldId": "incident_state", + "isVisible": true + }, + { + "fieldId": "incident_subcategory", + "isVisible": true + }, + { + "fieldId": "incident_tactic", + "isVisible": true + }, + { + "fieldId": "incident_tacticid", + "isVisible": true + }, + { + "fieldId": "incident_tags", + "isVisible": true + }, + { + "fieldId": "incident_target", + "isVisible": true + }, + { + "fieldId": "incident_teamname", + "isVisible": true + }, + { + "fieldId": "incident_technique", + "isVisible": true + }, + { + "fieldId": "incident_techniqueid", + "isVisible": true + }, + { + "fieldId": "incident_tenantname", + "isVisible": true + }, + { + "fieldId": "incident_threatfamilyname", + "isVisible": true + }, + { + "fieldId": "incident_threathuntingdetectedhostnames", + "isVisible": true + }, + { + "fieldId": "incident_threathuntingdetectedip", + "isVisible": true + }, + { + "fieldId": "incident_threatname", + "isVisible": true + }, + { + "fieldId": "incident_ticketacknowledgeddate", + "isVisible": true + }, + { + "fieldId": "incident_ticketcloseddate", + "isVisible": true + }, + { + "fieldId": "incident_ticketnumber", + "isVisible": true + }, + { + "fieldId": "incident_ticketopeneddate", + "isVisible": true + }, + { + "fieldId": "incident_urlsslverification", + "isVisible": true + }, + { + "fieldId": "incident_urls", + "isVisible": true + }, + { + "fieldId": "incident_usecasedescription", + "isVisible": true + }, + { + "fieldId": "incident_usercreationtime", + "isVisible": true + }, + { + "fieldId": "incident_userengagementresponse", + "isVisible": true + }, + { + "fieldId": "incident_usersid", + "isVisible": true + }, + { + "fieldId": "incident_users", + "isVisible": true + }, + { + "fieldId": "incident_verdict", + "isVisible": true + }, + { + "fieldId": "incident_appchannelname", + "isVisible": true + }, + { + "fieldId": "incident_similarincidents", + "isVisible": true + }, + { + "fieldId": "incident_useraccountcontrol", + "isVisible": true + } + ], + "isVisible": true, + "name": "Custom Fields", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + } + ] + }, + "group": "incident", + "id": "Sekoia XDR Layout", + "name": "Sekoia XDR Layout", + "system": false, + "version": -1, + "fromVersion": "6.10.0", + "marketplaces": [ + "xsoar" + ], + "description": "" } \ No newline at end of file