{{#if INCIDENT_SUMMARY}}
{{INCIDENT_SUMMARY}}
{{else if REASON}}{{REASON}}
{{/if}}Device | {{DEVICE_NAME}} |
Device username | {{DEVICE_EMAIL}} |
Policy | {{DEVICE_GROUP_NAME}} |
Policy ID | {{POLICY_ID}} |
Target value | {{TARGET_VALUE}} |
Severity | {{THREAT_SCORE}} |
Alert ID | {{INCIDENT_ID}} |
Alert created | {{LAST_UPDATE_TIME}} |
Event created | {{TIME}} |
Policy Applied | {{POLICY_ACTION}} |
ATT&CK tactic | {{ATTACK_TACTIC}} |
ATT&CK technique | {{ATTACK_TECHNIQUE}} |
Watchlist | {{#each WATCHLISTS}} {{this.name}} {{#unless @last}},{{/unless}} {{/each}} |
Process | {{APPLICATION_NAME}} |
Process path | {{PROCESS_PATH}} |
Reputation | {{REPUTATION}} |
Process username | {{PROCESS_USER_NAME}} |
Process SHA-256 | {{SHA256_HASH}} |
Parent process | {{PARENT_PROCESS_NAME}} |
Parent process username | {{PARENT_PROCESS_USER_NAME}} |
Parent process SHA-256 | {{PARENT_PROCESS_SHA256_HASH}} |
Child process | {{CHILD_PROCESS_NAME}} |
Child process username | {{CHILD_PROCESS_USER_NAME}} |
Child process SHA-256 | {{CHILD_PROCESS_SHA256_HASH}} |
Remote host | {{#if REMOTE_DOMAIN}}{{REMOTE_DOMAIN}} ({{REMOTE_IP}}){{else}}{{REMOTE_IP}}{{/if}} |
Remote host reputation | {{IP_REPUTATION}} |
Port | {{PORT}} |
Protocol | {{PROTOCOL}} |
Workload | {{WORKLOAD_NAME}} |
Workload kind | {{WORKLOAD_KIND}} |
Namespace | {{NAMESPACE}} |
Cluster | {{CLUSTER_NAME}} |
Product | {{PRODUCT_NAME}} |
Product ID | {{PRODUCT_ID}} |
Vendor | {{VENDOR_NAME}} |
Vendor ID | {{VENDOR_ID}} |
TMS Rule ID | {{TMS_RULE_ID}} |
{{linksLabel}} |
{{ this.label }} |
Application | {{#equal type "WATCHLIST"}} IOCs {{else}} TTPs {{/equal}} |
---|---|
{{this.[0].applicationName}} |
{{#each this}}
{{ this.indicatorName }}
{{#if @first}}
{{#if ../../IOC_HIT}}
({{#if ../../IOC_FIELD}}{{../../IOC_FIELD}}: {{/if}}{{../../IOC_HIT}})
{{/if}}
{{/if}}
{{/each}} |
This alert is based on notification settings specified in '{{RULE_NAME}}'. Update settings