{{#if INCIDENT_SUMMARY}}

{{INCIDENT_SUMMARY}}

{{else if REASON}}

{{REASON}}

{{/if}}
{{#if DEVICE_NAME}} {{/if}} {{#if DEVICE_EMAIL}} {{/if}} {{#if DEVICE_GROUP_NAME}} {{/if}} {{#if POLICY_ID}} {{/if}} {{#if TARGET_VALUE}} {{/if}} {{#if THREAT_SCORE}} {{/if}} {{#if INCIDENT_ID}} {{/if}} {{#if LAST_UPDATE_TIME}} {{/if}} {{#if TIME}} {{/if}} {{#if POLICY_ACTION}} {{/if}} {{#if ATTACK_TACTIC}} {{/if}} {{#if ATTACK_TECHNIQUE}} {{/if}} {{#if WATCHLISTS}} {{/if}} {{#if APPLICATION_NAME}} {{/if}} {{#if PROCESS_PATH}} {{/if}} {{#if REPUTATION}} {{/if}} {{#if PROCESS_USER_NAME}} {{/if}} {{#if SHA256_HASH}} {{/if}} {{#if PARENT_PROCESS_NAME}} {{/if}} {{#if PARENT_PROCESS_USER_NAME}} {{/if}} {{#if PARENT_PROCESS_SHA256_HASH}} {{/if}} {{#if CHILD_PROCESS_NAME}} {{/if}} {{#if CHILD_PROCESS_USER_NAME}} {{/if}} {{#if CHILD_PROCESS_SHA256_HASH}} {{/if}} {{#if REMOTE_IP}} {{/if}} {{#if IP_REPUTATION}} {{/if}} {{#if PORT}} {{/if}} {{#if PROTOCOL}} {{/if}} {{#if WORKLOAD_NAME}} {{/if}} {{#if WORKLOAD_KIND}} {{/if}} {{#if NAMESPACE}} {{/if}} {{#if CLUSTER_NAME}} {{/if}} {{#if PRODUCT_NAME }} {{/if}} {{#if PRODUCT_ID }} {{/if}} {{#if VENDOR_NAME }} {{/if}} {{#if VENDOR_ID }} {{/if}} {{#if TMS_RULE_ID }} {{/if}}
Device {{DEVICE_NAME}}
Device username {{DEVICE_EMAIL}}
Policy {{DEVICE_GROUP_NAME}}
Policy ID {{POLICY_ID}}
Target value {{TARGET_VALUE}}
Severity {{THREAT_SCORE}}
Alert ID {{INCIDENT_ID}}
Alert created {{LAST_UPDATE_TIME}}
Event created {{TIME}}
Policy Applied {{POLICY_ACTION}}
ATT&CK tactic {{ATTACK_TACTIC}}
ATT&CK technique {{ATTACK_TECHNIQUE}}
Watchlist {{#each WATCHLISTS}} {{this.name}} {{#unless @last}},{{/unless}} {{/each}}
Process {{APPLICATION_NAME}}
Process path {{PROCESS_PATH}}
Reputation {{REPUTATION}}
Process username {{PROCESS_USER_NAME}}
Process SHA-256 {{SHA256_HASH}}
Parent process {{PARENT_PROCESS_NAME}}
Parent process username {{PARENT_PROCESS_USER_NAME}}
Parent process SHA-256 {{PARENT_PROCESS_SHA256_HASH}}
Child process {{CHILD_PROCESS_NAME}}
Child process username {{CHILD_PROCESS_USER_NAME}}
Child process SHA-256 {{CHILD_PROCESS_SHA256_HASH}}
Remote host {{#if REMOTE_DOMAIN}}{{REMOTE_DOMAIN}} ({{REMOTE_IP}}){{else}}{{REMOTE_IP}}{{/if}}
Remote host reputation {{IP_REPUTATION}}
Port {{PORT}}
Protocol {{PROTOCOL}}
Workload {{WORKLOAD_NAME}}
Workload kind {{WORKLOAD_KIND}}
Namespace {{NAMESPACE}}
Cluster {{CLUSTER_NAME}}
Product {{PRODUCT_NAME}}
Product ID {{PRODUCT_ID}}
Vendor {{VENDOR_NAME}}
Vendor ID {{VENDOR_ID}}
TMS Rule ID {{TMS_RULE_ID}}
{{#if links}} {{#if linksLabel}} {{/if}} {{#each links}} {{/each}}
{{linksLabel}}
{{ this.label }}
{{/if}} {{#if THREAT_INDICATORS}} {{#each THREAT_INDICATORS}} {{/each}}
Application {{#equal type "WATCHLIST"}} IOCs {{else}} TTPs {{/equal}}
{{this.[0].applicationName}} {{#each this}} {{ this.indicatorName }} {{#if @first}} {{#if ../../IOC_HIT}} ({{#if ../../IOC_FIELD}}{{../../IOC_FIELD}}: {{/if}}{{../../IOC_HIT}}) {{/if}} {{/if}}
{{/each}}
{{/if}}

This alert is based on notification settings specified in '{{RULE_NAME}}'. Update settings