Common Types

Details
Content
Dependencies
Version History

This Content Pack will get you up and running in no-time and provide you with the most commonly used incident & indicator fields and types.

Pack Contributors:

Francisco Javier Fernández Jiménez
Timothy Roberts

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Pack Contributors:

Francisco Javier Fernández Jiménez
Timothy Roberts

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Classifiers

Name	Description
Mail Listener - Classifier	Classifies phishing email messages.
Mail Listener - Incoming Mapper	Maps incoming phishing email messages fields.

Incident Fields

Name	Description
Detected External IPs	Detected external IPs
Identity Type
Country	The country from which the user logged in.
Parent Process Path
Caller
Number of Related Incidents
Org Unit
Report Name
Operation Name
Technical Owner Contact	The contact details for the technical owner.
Start Time	The time when the offense started.
Device OS Version
Sensor Name
ASN Name
Additional Email Addresses
MITRE Tactic ID
SKU TIER
Comment	The comments related with the incident
Project ID
Resource Type
Endpoint
Process Names
Duration
Verification Status	The status of the user verification.
Policy Description
CVSS Confidentiality Requirement	The CVSS confidentiality requirement of the asset.
Source External IPs
Assignment Group
Application Id	Application Id
Event Type	Event Type
User Engagement Response
SHA1	SHA1
Org Level 3
Device External IPs
Categories	The categories for the incident.
Tactic ID
Subtype	Subtype
Post Nat Destination IP	The destination IP address after NAT.
End Time	The time when the offense ended.
Pre Nat Source IP	The source IP before NAT.
Registry Value
Endpoint Isolation Status
Phone Number	Phone number
Employee Display Name	The display name of the employee.
Dsts	The destination values.
Registry Key
Parent Process Name
First Name	First Name
Protocol - Event	The network protocol in the event.
Device Model	Device Model
Source Category
User Block Status
First Seen
CVSS Availability Requirement	The CVSS availability requirement for the asset.
Device Internal IPs
Closing User	The closing user.
Policy Actions
Policy URI
Post Nat Destination Port	The destination port after NAT.
High Risky Hosts
Tags
Custom Query Results
Classification	Incident Classification
Cloud Region List
Detection SLA	The time it took from incident creation until the maliciousness was determined.
Device Local IP	Device Local IP
SSDeep
Post Nat Source IP	The source IP address after NAT.
Location	Location
Source Port	The source port that was used
Src Ports	The source ports of the event.
Protocols
Additional Indicators
PID	PID
Policy Remediable
Alert Type ID
Process CMD
Destination IPs	The destination IPs of the event.
Referenced Resource ID
Destination Geolocation	The destination geolocation of the event.
Application Path
Rule Name	The name of a YARA rule
External Addresses
Manager Name	Manager Name
Threat Hunting Detected IP
Alert tags
Org Level 1
Timezone
Source Geolocation	The source geolocation of the event.
Source Created By
Related Endpoints
User SID
Attack Patterns
Command Line	Command Line
User Risk Level
Process Name
CMD line
Follow Up	True if marked for follow up.
Mobile Phone
Event ID	Event ID
Number of similar files
Asset ID
Policy ID
User Groups
Ticket Closed Date
Number Of Log Sources	The number of log sources related to the offense.
similarIncidents
Signature
Device Time	The time from the original logging device when the event occurred.
Technique
Detection ID
Suspicious Executions Found
sAMAccountName	User sAMAAccountName
Part of Campaign	The ID of the campaign incident of which the current incident is part of.
Parent Process MD5
Detected Users	Detected users
UUID	UUID as received from the integration JSON
File MD5
External Start Time
SHA256	SHA256
Domain Squatting Result	The result of the domain-squatting check for the attacker's email.
Country Name	Country Name
Alert Malicious	Whether the alert is malicious.
File Paths
Events	The events associated with the offense.
Src OS	Src OS
Error Code
Detected Internal Hosts	Detected internal hosts
Tool Usage Found
Rating
SKU Name
Unique Ports
Alert URL	Alert URL as received from the integration JSON
Agent ID	Agent ID
Scenario
Policy Details
External Severity
Internal Addresses
Group ID
userAccountControl	userAccountControl
Policy Type
File Name
Parent Process
Isolated	Isolated
IP Reputation
Threat Name	Define the threat name such as malware/exploit/phishing/etc
Asset Name
App message
Vulnerable Product
Street Address
Dst Ports	The destination ports of the event.
Post Nat Source Port	The source port after NAT.
Destination Port	The destination port used.
File SHA256
Application Name	Application Name
Location Region	Location Region
Last Modified On
Work Phone
OS	The operating system.
Source MAC Address	The source MAC address in an event.
Rendered HTML	The HTML content in a rendered form.
File Access Date
Compliance Notes	Notes regarding the assets compliance.
CMD
Campaign Name
Domain Registrar Abuse Email
Device Status
Reporter Email Address	The email address of the user who reported the email.
Src	Source
Last Seen
Risk Score
DNS Name	The DNS name of the asset.
Tactic
Device OU	Device's OU path in Active Directory
URL SSL Verification	Indicates whether the URLs passed the SSL certificate verification.
Log Source Type	The log source type associated with the event.
File Size	File Size
Team name
Traffic Direction	The direction of the traffic in the event.
Detection End Time
Investigation Stage	The stage of the investigation.
Src NT Domain	Source NT Domain
Source IPV6	The source IPV6 address.
Pre Nat Source Port	The source port before NAT.
Sub Category	The sub category
Source Urgency	Source Urgency
URLs
Resource ID
CVSS
Leadership
Log Source Name	The log source name associated with the event.
Device OS Name
ASN
Account Member Of
Pre Nat Destination Port	The destination port before NAT.
EmailCampaignCanvas
RemovedFromCampaigns
Related Campaign
Approval Status	The status for the approval of the request.
Src User	Source User
Objective
Ticket Acknowledged Date
Exposure Level
OS Type	OS Type
Last Name	Last Name
Technical Owner	The technical owner of the asset.
Incident Link
External Category ID
Tools
Referenced Resource Name
Failed Logon Events	The number of failed logon events in a specific timeframe. Can be used with reference to the "Failed Logon Events Timeframe" field.
Number Of Found Related Alerts	Medium or Higher Severity Alerts
File Creation Date
Threat Family Name	Threat Family Name Associated with an Attacking Vector. I.E. Meterpreter as toolkit or Extortion\ֿFraud\Espionage
External System ID
app channel name
Username	The username of the account who logged in.
Cloud Instance ID	Cloud Instance ID
Process MD5
Related Report
Block Indicators Status
Surname	Surname
External Sub Category Name
Source Username	The username that was the source of the attack.
Job Code	Job Code
Alert Attack Time
Usernames	The username in the event.
Parent CMD line
Time to Assignment	The time it took from when the incident was created until a user was assigned to it.
Similar incidents Dbot
Title	Title
External Link
Destination Hostname	Destination hostname
Remediation SLA	The time it took since remediation of the incident began, and until it ended.
External Status
Category Count	The number of categories that are associated with the offense.
Log Source	Log Source
Source Hostname	The hostname that performed the port scan.
Process Creation Time
User Creation Time
Process Paths
Protocol names
Detected External Hosts	Detected external hosts
External End Time
Account ID
Cloud Resource List
Use Case Description
Alert Name	Alert name as received from the integration JSON
File Upload	Used to upload files to incidents in a way that would make them distinguishable from the rest of the incident files. This field can be used, for example, to execute commands on manually uploaded files with the click of an incident layout button.
User Id	User Id
Low Level Categories Events	The low level category of the event.
Resource Name
List Of Rules - Event	The list of rules associated to an event.
Registry Value Type
Hostnames	The hostname in the event.
Agent Version	Reporting Agent/Sensor Version
Department	Department
MD5	MD5
Given Name	Given Name
Dest NT Domain	Destination NT Domain
Source IP	The IP Address that the user initially logged in from.
Resource URL
Job Family	Job Family
User Agent
Source Updated by
Triage SLA	The time it took to investigate and enrich incident information.
Protocol	Protocol
Ticket Number
Critical Assets	A table of critical assets involved in the incident, including the name and asset type.
Account Status
Device External IP	Device External IP
External Sub Category ID
Cloud Account ID
Display Name	Display Name
Device Id	Device Id
Dest Hostname	Destination hostname
File Names
Cost Center Code	Cost Center Code
Vulnerability Category
Password Changed Date
Source Network
SHA512	SHA512
Employee Email	The email address of the employee.
Src Hostname	Source hostname
Region ID
Org Level 2
Device Name	Device Name
File Hash
External ID
MITRE Tactic Name
Event Names	The event name (translated QID ) in the event.
EmailCampaignSummary
Failed Logon Events Timeframe	The timeframe which the failed logon events occurred in.
Last Mirrored Time Stamp	The last time the incident was mirrored in.
Last Update Time
Zip Code	Zip Code
MITRE Technique Name
Hunt Results Count
Destination MAC Address	The destination MAC address in an event.
External Last Updated Time
Policy Deleted
Event Descriptions	The description of the event name.
Alert Rules
Blocked Action	Blocked Action
App
Selected Indicators	Includes the indicators selected by the user.
Appliance ID	Appliance ID as received from the integration JSON
Detected IPs
Registry Hive
Policy Recommendation
Related Alerts
Detected Internal IPs	Detected internal IPs
CVSS Integrity Requirement	The CVSS integrity requirement for the asset.
Affected Hosts
Tenant Name	Tenant Name
Region
EmailCampaignSnippets
File SHA1
Birthday	Person's Birthday
Process SHA256
Suspicious Executions
Affected Users
MAC Address	MAC Address
Alert ID	Alert ID as received from the integration JSON
Alert Acknowledgement	Alert acknowledgement as received from the integration JSON
Item Owner Email
Child Process
Audit Logs
OS Version	OS Version
Full Name	Person's Full Name
Cloud Operation Type
Policy Severity
Vendor ID
Triggered Security Profile	Triggered Security Profile
State	State
Destination Network
Dest	Destination
Approver	The person who approved or needs to approve the request.
Employee Manager Email	The email address of the employee's manager.
Detection URL	URL of the ExtraHop Reveal(x) detection
OutgoingMirrorError
Source Create time
High Risky Users
Ticket Opened Date
Account Name	Account Name
Threat Hunting Detected Hostnames
Source Priority
Command Line Verdict
String Similarity Results
Alert Action	Alert action as received from the integration JSON
Assigned User	Assigned User
Verdict
CVSS Collateral Damage Potential	The CVSS collateral damage potential of the asset.
Parent Process SHA256
Source IPs	The source IPs of the event.
Item Owner
Device Username	The username of the user that owns the device
IP Blocked Status
Password Reset Successfully	Whether the password has been successfully reset.
Destination IP	The IP address the impossible traveler logged in to.
Risk Rating
Process ID
MITRE Technique ID
Incident Duration	How long it took for the playbook of the incident to finish, from the moment it started.
Close Time	The closing time.
Registration Email
Destination Networks
File Relationships
City
Vendor Product
CVE Published
Last Modified By
External Confidence
Macro Source Code	In case there's a macro in a Microsoft file such as docm, xlsm or pptm, this field will hold the source code of the macro.
Destination IPV6	The destination IPV6 address.
Status Reason
Users
Detected Endpoints
Cost Center	Cost Center
Srcs	The source values.
File Path
Parent Process IDs
Country Code
User Anomaly Count
Source Id
Process Path
Alert Category	The category of the alert
EmailCampaignMutualIndicators
Email	Primary Email Address
Device Hash	Device Hash
Bugtraq
CVE ID
Additional Data
Agents ID
High Level Categories	The high level categories in the events.
Domain Name
Alert Source
Country Code Number
Raw Event	The unparsed event data.
Email Sent Successfully	Whether the email has been successfully sent.
Containment SLA	The time it took to contain the incident.
External Category Name
Is Active	Alert status
Users Details
Source Status
Verification Method	The method used to verify the user.
Detection Update Time
Parent Process File Path
Source Networks
Attack Mode	Attack mode as received from the integration JSON
CVE
Mobile Device Model
Acquisition Hire
Job Function	Job Function
Cloud Service
Dest OS	Destination OS
Appliance Name	Appliance name as received from the integration JSON
Sensor IP
Personal Email
Event Action	Action taken on user accounts - Create, Update, Deactivate, Reactivate
Manager Email Address
Device MAC Address
Endpoints Details
Changed	The user who changed this incident
Description	The description of the incident
Error Message	The error message that contains details about the error that occurred.
Technique ID
Escalation
Risk Name
Closing Reason	The closing reason
Detected User
Parent Process CMD
Domain Updated Date
IncomingMirrorError
Technical User	The technical user of the asset.

Incident Types

Name	Description
Hunt
C2Communication
Indicator Feed
Policy Violation
Defacement
Lateral Movement
Exfiltration
Reconnaissance
UnknownBinary
Network
Job
DoS
Exploit
Simulation
Authentication
Vulnerability

Indicator Fields

Name	Description
Primary Motivation
Targets
Entry ID
Manager Name	Manager Name
Validity Not Before	Specifies the date on which the certificate validity period begins.
Applications
Signed
Registrar Abuse Country
Signature Internal Name
Country Name
Description
Subdomains
Registrar Abuse Network
Goals
Service	The specific service of a feed integration from which an indicator was ingested.
Organizational Unit (OU)
Key Value
Subject Alternative Names
STIX Threat Actor Types
Email Address
Operating System Refs
Report type
Job Family
Whois Records
Tool Types
Campaign
Architecture
Category
Mitre Tactics
Community Notes
Name
Reports
Memory
Threat Types	The threat category associated to this indicator by the source vendor. For example, Phishing, Command \u0026 Control, TOR, etc.
Extension
Published
Vendor
Report Object References	A list of STIX IDs referenced in the report.
SPKI SHA256	SHA256 fingerprint of Subject Public Key Info
First Seen By Source	The first time the indicator was seen by the source vendor.
Domain IDN Name
Certificates
STIX Description
STIX Aliases	Alternative names used to identify this object
STIX Tool Types
Size
AS Owner
Registrant Phone
Mobile Phone
Identity class	The type of entity that this Identity describes, e.g., an individual or organization.
STIX Primary Motivation.
DNS
CPE	Specifies the Common Platform Enumeration (CPE) entry for the software, if available. The value for this property MUST be a CPE v2.3 entry from the official NVD CPE Dictionary
Force Sync	Whether to force user synchronization.
Domain Name
Positive Detections	Number of engines that positively detected the indicator as malicious
Admin Country
Registrant Email
Office365ExpressRoute
Zip Code
Number of subkeys
STIX Goals
Action
Behavior
Registrant Country
Acquisition Hire	Whether the employee is an acquisition hire.
OS Version
Groups
STIX Roles
Department	Department
Registrar Name
Issuer DN	Issuer Distinguished Name
Paths
Short Description
CVE Description
Registrar Abuse Address
CVSS Version
BIOS Version
Quarantined	Whether the indicator is quarantined or isolated
Signature Algorithm
SHA256
Is Malware Family
SSDeep
STIX Kill Chain Phases	The list of Kill Chain Phases for which this object is used.
Admin Name
MAC Address
Country Code
Processor
Is Processed
STIX ID	An identifier uniquely identifies a STIX Object and MAY do so in a deterministic way
Source Priority
Region
STIX Is Malware Family
MD5
STIX Sophistication
Location
Certificate Names
Detection Engines	Total number of engines that checked the indicator
Cost Center
Organization Last Seen	Date and time when the indicator was last seen in the organization.
SWID	Specifies the Software Identification (SWID) tags entry for the software
Name Field
Path
Certificate Signature
Malware Family
Public Key
Organization
Objective
Malware types
Issuer
Vulnerable Products
Job Function
Resource Level
Feed Related Indicators
CVSS Table
Domains
Signature Original Name
Certificate Validation Checks
Associated File Names
Samples
Office365Required
Rank	Used to display rank from different sources
Query Language
Subject DN	Subject Distinguished Name
Org Unit
Office365Category
Capabilities
Reported By	The source that reported this indicator. Can be a feed, an incident, or users.
Download URL
STIX Resource Level
Manager Email Address
File Type
Tool Version
Aliases	Alternative names used to identify this object
Registrant Name
Processors
Kill Chain Phases	The list of Kill Chain Phases for which this object is used.
Blocked
Organization Type
Signature Authentihash
Domain Referring Subnets
Author
Signature Copyright
Geo Country
Geo Location
Display Name
DNS Records
Domain Referring IPs
Leadership
Threat Actor Types
X.509 v3 Extensions
SHA512
Associations	Known associations to other pieces of Threat Data.
Global Prevalence	The number of times the indicator is detected across all organizations.
Cost Center Code
Name Servers
Source Original Severity	The original score/severity provided by the source without DBot translation.
Org Level 3
STIX Tool Version
Version
Last Seen By Source	The last time the indicator was seen by the Source vendor.
Tags
Operating System
Organization Prevalence	The number of times the indicator is detected in the organization.
Organization First Seen	Date and time when the indicator was first seen in the organization.
Mitre ID
Surname	Surname
Signature File Version
Hostname
Languages	Specifies the languages supported by the software. The value of each list member MUST be a language code conformant to - RFC5646.
Sophistication
Email
Given Name	Given Name
Vulnerabilities
Expiration Date
CVSS3
Street Address
Confidence
Roles
Account Type
IP Address
Country Code Number
Assigned role
Serial Number
Work Phone
Implementation Languages
Creation Date
ASN
Traffic Light Protocol	TLP is a set of designations used to ensure that sensitive information is shared with the appropriate audience. It employs four colors to indicate expected sharing boundaries to be applied by the recipient(s).
Secondary Motivations
Registrar Abuse Email
Validity Not After	Specifies the date on which the certificate validity period ends.
City	City
Detections
Port
Assigned user
Infrastructure Types
Indicator Identification
Location Region
CVSS
File Extension
User ID
State
Org Level 2
Operating System Version
SHA1
Publications
Job Code	Job Code
STIX Malware Types
Industry sectors	Industry sector is an open vocabulary that describes industrial and commercial sectors.
CVE Modified
CVSS Score
PEM	Certificate in PEM format.
imphash
Registrar Abuse Phone
DHCP Server
Admin Phone
Title	Title
Internal
Domain Status
Org Level 1
Definition
STIX Secondary Motivations
Device Model
Updated Date
Username
Subject
Product
Commands
Registrar Abuse Name
Signature Description
CVSS Vector
Actor
Personal Email
Admin Email

Layouts

Name	Description
Email Indicator	Email Indicator Layout
Registry Key Indicator	Registry Key Indicator Layout
IP Indicator	IP Indicator Layout
Domain Indicator	Domain Indicator Layout
Host Indicator	Host indicator layout
Campaign	Campaign Indicator Layout
Tool Indicator	Tool Indicator Layout
Vulnerability Incident
Software	Software Indicator Layout
Account Indicator	Account Indicator Layout
Intrusion Set	Intrusion Set Layout
Report	Report Indicator Layout
Malware Indicator	Malware Indicator Layout
Course of Action	Course of Action Indicator Layout
Mutex	Mutex indicator layout
URL Indicator	URL Indicator Layout
Tactic Layout	Tactic Indicator Layout
Threat Actor	Threat Actor Indicator Layout
Indicator Feed Incident
CVE Indicator	CVE Indicator Layout
ASN	ASN Indicator Layout
Attack Pattern	Attack Pattern Indicator Layout
X509 Certificate	CVE Indicator Layout
Identity	Identity indicator layout
Infrastructure	Infrastructure Indicator Layout
File Indicator	File Indicator Layout
Location	Location indicator layout

Indicator Types

Name	Description
IP
Software
File MD5
Report
Campaign
File SHA-1
Location
Tool
Intrusion Set
Threat Actor
Identity
CVE
Host
ASN
Mutex
Attack Pattern
DomainGlob
IPv6
Malware
Infrastructure
File SHA-256
Domain
Course of Action
X509 Certificate
ssdeep
Tactic
URL
Account
Onion Address
CIDR
Email
IPv6CIDR
Registry Key
File

Classifiers

Name	Description
Mail Listener - Classifier	Classifies phishing email messages.
Mail Listener - Incoming Mapper	Maps incoming phishing email messages fields.

Incident Fields

Name	Description
sAMAccountName	User sAMAAccountName
External Status
Resource URL
RemovedFromCampaigns
Device Status
Tool Usage Found
High Risky Users
SHA512	SHA512
IncomingMirrorError
Users Details
Cost Center Code	Cost Center Code
Device MAC Address
Job Family	Job Family
User Groups
Project ID
Error Code
Unique Ports
Approval Status	The status for the approval of the request.
Verdict
CVE
OutgoingMirrorError
External Last Updated Time
Agents ID
Traffic Direction	The direction of the traffic in the event.
Item Owner
CVSS Integrity Requirement	The CVSS integrity requirement for the asset.
Process SHA256
Vendor Product
User Engagement Response
Dest OS	Destination OS
Process ID
Policy Severity
Account Status
UUID	UUID as received from the integration JSON
EmailCampaignSnippets
Internal Addresses
Original Alert ID	Alert ID as received from the integration JSON
Team name
Event Names	The event name (translated QID ) in the event.
Surname	Surname
Job Code	Job Code
Source Create time
Device Time	The time from the original logging device when the event occurred.
Alert Acknowledgement	Alert acknowledgement as received from the integration JSON
Cloud Region List
File Creation Date
Dsts	The destination values.
Detection URL	URL of the ExtraHop Reveal(x) detection
Command Line Verdict
List Of Rules - Event	The list of rules associated to an event.
Technique
Approver	The person who approved or needs to approve the request.
Policy Type
Detected External IPs	Detected external IPs
Acquisition Hire
Group ID
Closing User	The closing user.
Post Nat Destination IP	The destination IP address after NAT.
Assigned User	Assigned User
Vulnerability Category
Escalation
Risk Rating
Threat Name	Define the threat name such as malware/exploit/phishing/etc
Blocked Action	Blocked Action
Risk Name
User Id	User Id
End Time	The time when the offense ended.
File SHA1
Failed Logon Events	The number of failed logon events in a specific timeframe. Can be used with reference to the "Failed Logon Events Timeframe" field.
Bugtraq
Agent Version	Reporting Agent/Sensor Version
CVE ID
Part of Campaign	The ID of the campaign incident of which the current incident is part of.
Asset Name
Error Message	The error message that contains details about the error that occurred.
Attack Patterns
File Access Date
Last Update Time
Suspicious Executions Found
Org Level 3
Password Changed Date
First Name	First Name
Destination Geolocation	The destination geolocation of the event.
Source Geolocation	The source geolocation of the event.
Additional Data
Detection End Time
Parent Process IDs
Detection ID
Verification Method	The method used to verify the user.
Duration
Endpoints Details
Region
User Creation Time
Is Active	Alert status
Log Source	Log Source
Ticket Closed Date
Registry Value
Given Name	Given Name
Country Code
Leadership
Last Modified On
City
Detection SLA	The time it took from incident creation until the maliciousness was determined.
Registry Hive
Job Function	Job Function
Process Creation Time
Resource Name
Policy Remediable
App message
High Risky Hosts
EmailCampaignSummary
Pre Nat Destination Port	The destination port before NAT.
Technical User	The technical user of the asset.
OS	The operating system.
Related Alerts
Process MD5
Sub Category	The sub category
SSDeep
Number Of Found Related Alerts	Medium or Higher Severity Alerts
Vendor ID
Password Reset Successfully	Whether the password has been successfully reset.
Low Level Categories Events	The low level category of the event.
Policy Description
Technical Owner Contact	The contact details for the technical owner.
Email Sent Successfully	Whether the email has been successfully sent.
Mobile Device Model
Affected Users
MITRE Tactic Name
MITRE Technique Name
Closing Reason	The closing reason
Detected Internal Hosts	Detected internal hosts
Referenced Resource Name
Alert Malicious	Whether the alert is malicious.
Full Name	Person's Full Name
External Category ID
Alert tags
External Sub Category ID
Use Case Description
EmailCampaignMutualIndicators
Cloud Instance ID	Cloud Instance ID
CVSS Availability Requirement	The CVSS availability requirement for the asset.
Number Of Log Sources	The number of log sources related to the offense.
Post Nat Destination Port	The destination port after NAT.
Number of similar files
Comment	The comments related with the incident
Source External IPs
Close Time	The closing time.
Display Name	Display Name
EmailCampaignCanvas
String Similarity Results
Identity Type
similarIncidents
Pre Nat Source IP	The source IP before NAT.
Tactic ID
Assignment Group
Location	Location
Street Address
Cloud Resource List
Tactic
Related Endpoints
Ticket Number
Original Description	The description of the incident
Referenced Resource ID
State	State
Source Priority
Domain Name
Device OU	Device's OU path in Active Directory
Start Time	The time when the offense started.
User SID
IP Reputation
ASN Name
External Link
Personal Email
Device Internal IPs
Post Nat Source Port	The source port after NAT.
Work Phone
SHA1	SHA1
Status Reason
Parent Process SHA256
Parent Process CMD
Post Nat Source IP	The source IP address after NAT.
Technique ID
Scenario
Raw Event	The unparsed event data.
Related Report
Alert Rules
Title	Title
Birthday	Person's Birthday
Alert Type ID
Process Paths
Registry Value Type
Investigation Stage	The stage of the investigation.
Application Path
Event Descriptions	The description of the event name.
Device External IPs
Rating
Source Updated by
ASN
Additional Email Addresses
URLs
CVSS Collateral Damage Potential	The CVSS collateral damage potential of the asset.
Changed	The user who changed this incident
Detected Endpoints
Zip Code	Zip Code
Source Urgency	Source Urgency
Device OS Version
Process Names
Source Category
Rendered HTML	The HTML content in a rendered form.
Failed Logon Events Timeframe	The timeframe which the failed logon events occurred in.
Original Alert Source
Similar incidents Dbot
User Anomaly Count
Mobile Phone
CVSS
File Size	File Size
Time to Assignment	The time it took from when the incident was created until a user was assigned to it.
Device Name	Device Name
Registration Email
Event Action	Action taken on user accounts - Create, Update, Deactivate, Reactivate
Parent Process Name
Follow Up	True if marked for follow up.
Vulnerable Product
Triggered Security Profile	Triggered Security Profile
Remediation SLA	The time it took since remediation of the incident began, and until it ended.
Selected Indicators	Includes the indicators selected by the user.
Registry Key
Subtype	Subtype
Custom Query Results
User Block Status
Threat Family Name	Threat Family Name Associated with an Attacking Vector. I.E. Meterpreter as toolkit or Extortion\ֿFraud\Espionage
Critical Assets	A table of critical assets involved in the incident, including the name and asset type.
Destination IPV6	The destination IPV6 address.
Original Events	The events associated with the offense.
Parent Process MD5
Region ID
Src OS	Src OS
Asset ID
Tenant Name	Tenant Name
Domain Updated Date
SKU TIER
CVSS Confidentiality Requirement	The CVSS confidentiality requirement of the asset.
Phone Number	Phone number
Org Level 1
Parent Process File Path
Item Owner Email
Objective
Last Mirrored Time Stamp	The last time the incident was mirrored in.
Affected Hosts
Device Id	Device Id
Manager Name	Manager Name
Category Count	The number of categories that are associated with the offense.
Operation Name
External System ID
Device Hash	Device Hash
Original Alert Name	Alert name as received from the integration JSON
Source Networks
File Relationships
Location Region	Location Region
Campaign Name
Last Seen
Source Created By
Log Source Type	The log source type associated with the event.
Technical Owner	The technical owner of the asset.
Process CMD
Macro Source Code	In case there's a macro in a Microsoft file such as docm, xlsm or pptm, this field will hold the source code of the macro.
Triage SLA	The time it took to investigate and enrich incident information.
External Start Time
Suspicious Executions
Policy Recommendation
Employee Email	The email address of the employee.
Compliance Notes	Notes regarding the assets compliance.
Tools
Alert Action	Alert action as received from the integration JSON
External Severity
Caller
External End Time
Risk Score
Policy ID
Report Name
IP Blocked Status
Rule Name	The name of a YARA rule
MITRE Technique ID
Parent Process Path
Device OS Name
Signature
Classification	Incident Classification
Protocol names
Last Modified By
Event ID	Event ID
Cloud Account ID
Policy Details
Source Status
SKU Name
Cost Center	Cost Center
app channel name
URL SSL Verification	Indicates whether the URLs passed the SSL certificate verification.
Endpoint Isolation Status
Org Unit
File Hash
Org Level 2
Device Model	Device Model
Account ID
Additional Indicators
Block Indicators Status
Sensor IP
Employee Display Name	The display name of the employee.
Last Name	Last Name
Domain Squatting Result	The result of the domain-squatting check for the attacker's email.
Pre Nat Source Port	The source port before NAT.
Verification Status	The status of the user verification.
Email	Primary Email Address
Employee Manager Email	The email address of the employee's manager.
Ticket Acknowledged Date
Audit Logs
Account Member Of
MITRE Tactic ID
External Category Name
External Confidence
Department	Department
Incident Link
Containment SLA	The time it took to contain the incident.
Policy URI
Number of Related Incidents
userAccountControl	userAccountControl
Reporter Email Address	The email address of the user who reported the email.
Manager Email Address
Country Code Number
Resource Type
Policy Deleted
Log Source Name	The log source name associated with the event.
Cloud Service
Exposure Level
Policy Actions
CVE Published
Attack Mode	Attack mode as received from the integration JSON
Destination Networks
OS Type	OS Type
Timezone
Related Campaign
First Seen
Hunt Results Count
Source Id
Domain Registrar Abuse Email
Isolated	Isolated
External Sub Category Name

Incident Types

Name	Description
Defacement
Network
Lateral Movement
DoS
Indicator Feed
Hunt
Job
Policy Violation
Reconnaissance
UnknownBinary
Simulation
Authentication
C2Communication
Exfiltration
Exploit
Vulnerability

Indicator Fields

Name	Description
Short Description
Groups
Last Seen By Source	The last time the indicator was seen by the Source vendor.
Public Key
Creation Date
Community Notes
Confidence
Quarantined	Whether the indicator is quarantined or isolated
Job Function
First Seen By Source	The first time the indicator was seen by the source vendor.
File Extension
Department	Department
Name Servers
Tool Types
Certificates
Entry ID
Query Language
Organization Prevalence	The number of times the indicator is detected in the organization.
Blocked
Architecture
Surname	Surname
STIX Is Malware Family
Mitre Tactics
Goals
Organizational Unit (OU)
Behavior
Malware Family
Domains
Description
Product
Registrar Abuse Phone
Secondary Motivations
Issuer
Is Malware Family
Domain Referring IPs
STIX Sophistication
Organization Type
X.509 v3 Extensions
Report Object References	A list of STIX IDs referenced in the report.
Operating System
Paths
Mobile Phone
Publications
State
Implementation Languages
Admin Name
Signature Internal Name
Roles
STIX Secondary Motivations
Subject DN	Subject Distinguished Name
CVE Modified
Indicator Identification
Subdomains
Domain Referring Subnets
Organization First Seen	Date and time when the indicator was first seen in the organization.
SHA512
Vulnerable Products
Email
Objective
STIX Tool Version
Download URL
Cost Center
STIX Kill Chain Phases	The list of Kill Chain Phases for which this object is used.
Operating System Version
Certificate Names
Service	The specific service of a feed integration from which an indicator was ingested.
Languages	Specifies the languages supported by the software. The value of each list member MUST be a language code conformant to - RFC5646.
Name Field
Reported By	The source that reported this indicator. Can be a feed, an incident, or users.
BIOS Version
Version
Rank	Used to display rank from different sources
Country Code Number
Signature Copyright
Registrant Name
Leadership
Registrar Name
Registrant Phone
SSDeep
Serial Number
AS Owner
CVSS3
Memory
City	City
Threat Types	The threat category associated to this indicator by the source vendor. For example, Phishing, Command \u0026 Control, TOR, etc.
IP Address
Threat Actor Types
Positive Detections	Number of engines that positively detected the indicator as malicious
Geo Country
Location
Signature Algorithm
Associations	Known associations to other pieces of Threat Data.
Org Level 3
OS Version
DNS Records
CVSS Table
CVSS Vector
Geo Location
Identity class	The type of entity that this Identity describes, e.g., an individual or organization.
STIX Description
Commands
Registrar Abuse Name
Assigned user
Organization Last Seen	Date and time when the indicator was last seen in the organization.
ASN
CVSS Score
Cost Center Code
Personal Email
DHCP Server
Domain IDN Name
Processors
Manager Name	Manager Name
Domain Status
Updated Date
Tool Version
Port
Account Type
STIX ID	An identifier uniquely identifies a STIX Object and MAY do so in a deterministic way
Applications
Processor
File Type
Registrant Country
Country Name
Domain Name
CVE Description
Registrar Abuse Country
Capabilities
Device Model
Display Name
Validity Not Before	Specifies the date on which the certificate validity period begins.
Primary Motivation
Job Code	Job Code
Tags
Action
Signature Description
SHA256
Category
Registrar Abuse Email
STIX Aliases	Alternative names used to identify this object
Key Value
Signature File Version
Vendor
STIX Tool Types
MD5
Subject Alternative Names
Issuer DN	Issuer Distinguished Name
STIX Malware Types
Traffic Light Protocol	TLP is a set of designations used to ensure that sensitive information is shared with the appropriate audience. It employs four colors to indicate expected sharing boundaries to be applied by the recipient(s).
Hostname
PEM	Certificate in PEM format.
Certificate Signature
Certificate Validation Checks
Number of subkeys
Source Priority
Operating System Refs
SWID	Specifies the Software Identification (SWID) tags entry for the software
Org Unit
SHA1
Email Address
SPKI SHA256	SHA256 fingerprint of Subject Public Key Info
Office365Category
Mitre ID
DNS
Global Prevalence	The number of times the indicator is detected across all organizations.
Report type
Org Level 1
Signature Original Name
Infrastructure Types
Admin Phone
Aliases	Alternative names used to identify this object
Given Name	Given Name
Registrant Email
Detections
Sophistication
Feed Related Indicators
Street Address
Zip Code
STIX Roles
Targets
STIX Primary Motivation.
STIX Resource Level
Admin Email
Industry sectors	Industry sector is an open vocabulary that describes industrial and commercial sectors.
CVSS
Published
Internal
imphash
Expiration Date
Is Processed
Registrar Abuse Address
User ID
Username
Signature Authentihash
Detection Engines	Total number of engines that checked the indicator
Subject
Signed
Region
Registrar Abuse Network
Acquisition Hire	Whether the employee is an acquisition hire.
Location Region
Name
STIX Goals
CPE	Specifies the Common Platform Enumeration (CPE) entry for the software, if available. The value for this property MUST be a CPE v2.3 entry from the official NVD CPE Dictionary
Author
Office365ExpressRoute
Kill Chain Phases	The list of Kill Chain Phases for which this object is used.
Job Family
Force Sync	Whether to force user synchronization.
Source Original Severity	The original score/severity provided by the source without DBot translation.
Malware types
Org Level 2
Definition
CVSS Version
Vulnerabilities
Manager Email Address
Resource Level
Title	Title
Path
Organization
Validity Not After	Specifies the date on which the certificate validity period ends.
Whois Records
Size
Extension
Country Code
Actor
STIX Threat Actor Types
Office365Required
Campaign
Work Phone
Associated File Names
Samples
Reports
Admin Country
Assigned role

Layoutrule

Name	Description
Indicator Feed Layout Rule
Vulnerability Layout Rule

Layouts

Name	Description
Host Indicator	Host indicator layout
Domain Indicator	Domain Indicator Layout
Report	Report Indicator Layout
Malware Indicator	Malware Indicator Layout
CVE Indicator	CVE Indicator Layout
Intrusion Set	Intrusion Set Layout
Infrastructure	Infrastructure Indicator Layout
Indicator Feed Incident
Tactic Layout	Tactic Indicator Layout
Threat Actor	Threat Actor Indicator Layout
Registry Key Indicator	Registry Key Indicator Layout
Vulnerability Incident
IP Indicator	IP Indicator Layout
Mutex	Mutex indicator layout
Tool Indicator	Tool Indicator Layout
Campaign	Campaign Indicator Layout
Email Indicator	Email Indicator Layout
URL Indicator	URL Indicator Layout
File Indicator	File Indicator Layout
Account Indicator	Account Indicator Layout
Identity	Identity indicator layout
Attack Pattern	Attack Pattern Indicator Layout
Course of Action	Course of Action Indicator Layout
ASN	ASN Indicator Layout
Software	Software Indicator Layout
Location	Location indicator layout
X509 Certificate	CVE Indicator Layout

Indicator Types

Name	Description
Email
Campaign
URL
ASN
Malware
Registry Key
DomainGlob
Threat Actor
Attack Pattern
File
CVE
ssdeep
Domain
Intrusion Set
Tactic
File SHA-256
Tool
Report
Course of Action
Host
Infrastructure
IPv6
Onion Address
CIDR
File SHA-1
X509 Certificate
Account
Identity
IP
Software
Mutex
File MD5
Location
IPv6CIDR

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

Optional Content Packs (60)

Pack Name	Pack By
AWS - GuardDuty	By: Cortex XSOAR
AWS - Security Hub	By: Cortex XSOAR
Access Investigation	By: Cortex XSOAR
Microsoft Sentinel	By: Cortex XSOAR
Brute Force	By: Cortex XSOAR
Phishing Campaign	By: Cortex XSOAR
Carbon Black Endpoint Standard	By: Cortex XSOAR
Carbon Black Enterprise Response	By: Cortex XSOAR
Change Management	By: Cortex XSOAR
Cortex XDR by Palo Alto Networks	By: Cortex XSOAR
CrowdStrike Falcon	By: Cortex XSOAR
Cyberint	By: Cyberint
Doppel	By: Doppel Inc
Employee Offboarding	By: Cortex XSOAR
Exabeam Advanced Analytics	By: Cortex XSOAR
Exabeam Security Operations Platform	By: Cortex XSOAR
ExtraHop Reveal(x)	By: ExtraHop
Trellix Email Security - Cloud	By: Cortex XSOAR
FireEye Email Security (EX)	By: Cortex XSOAR
FireEye HX	By: Cortex XSOAR
FireEye Network Security (NX)	By: Cortex XSOAR
FraudWatch PhishPortal	By: Cortex XSOAR
Freshworks Freshservice	By: Cortex XSOAR
GDPR	By: Cortex XSOAR
GravityZone	By: Bitdefender
Akamai GuardiCore	By: Cortex XSOAR
IBM Security QRadar SOAR	By: Cortex XSOAR
Impossible Traveler	By: Cortex XSOAR
Rapid7 - Threat Command (IntSights)	By: Rapid7
LogRhythm	By: Cortex XSOAR
Malware Core	By: Cortex XSOAR
Malware Investigation and Response	By: Cortex XSOAR
Microsoft Defender for Cloud Apps	By: Cortex XSOAR
Microsoft Defender for Endpoint	By: Cortex XSOAR
Microsoft Graph Security	By: Cortex XSOAR
Netskope	By: Cortex XSOAR
Nutanix Hypervisor	By: Cortex XSOAR
OpsGenie	By: Cortex XSOAR
OrionMalware	By: Airbus
Enterprise DLP by Palo Alto Networks	By: Palo Alto Networks Enterprise DLP
Password Reset via Chatbot	By: Cortex XSOAR
PCAP Analysis	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
Port Scan	By: Cortex XSOAR
Prisma Cloud by Palo Alto Networks	By: Cortex XSOAR
Prisma Cloud Compute by Palo Alto Networks	By: Cortex XSOAR
SaaS Security by Palo Alto Networks	By: Cortex XSOAR
IBM QRadar	By: Cortex XSOAR
NetWitness	By: Netwitness
Mandiant Automated Defense	By: Mandiant
Skyhigh Security SSE	By: Cortex XSOAR
Splunk	By: Cortex XSOAR
Stamus	By: Stamus Networks
Symantec Data Loss Prevention	By: Cortex XSOAR
SysAid	By: Cortex XSOAR
Tanium Threat Response	By: Cortex XSOAR
ThreatConnect	By: Cortex XSOAR
TrendAI™ Cloud App Security	By: Cortex XSOAR
Tripwire	By: Cortex XSOAR
Vectra AI	By: Vectra TME Integrations

All level dependencies (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR

3.10.17 - 13782934 (October 14, 2026)

Documentation and metadata improvements.

Related pull requests:
- 46240

Download

3.10.16 - 13710525 (October 11, 2026)

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 46192

Download

3.10.15 - 11803561 (August 10, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45412

Download

3.10.14 - 11786168 (August 9, 2026)

Classifiers

Mail Listener - Classifier

Documentation and metadata improvements.

Incident Fields

ASN
Documentation and metadata improvements.
ASN Name
Documentation and metadata improvements.
Account ID
Documentation and metadata improvements.
Account Member Of
Documentation and metadata improvements.
Account Status
Documentation and metadata improvements.
Acquisition Hire
Documentation and metadata improvements.
Additional Data
Documentation and metadata improvements.
Additional Email Addresses
Documentation and metadata improvements.
Additional Indicators
Documentation and metadata improvements.
Affected Hosts
Documentation and metadata improvements.
Affected Users
Documentation and metadata improvements.
Agent Version
Documentation and metadata improvements.
Agents ID
Documentation and metadata improvements.
Alert Acknowledgement
Documentation and metadata improvements.
Alert Action
Documentation and metadata improvements.
Alert Malicious
Documentation and metadata improvements.
Alert Rules
Documentation and metadata improvements.
Alert Type ID
Documentation and metadata improvements.
Alert tags
Documentation and metadata improvements.
App message
Documentation and metadata improvements.
Application Path
Documentation and metadata improvements.
Approval Status
Documentation and metadata improvements.
Approver
Documentation and metadata improvements.
Asset ID
Documentation and metadata improvements.
Asset Name
Documentation and metadata improvements.
Assigned User
Documentation and metadata improvements.
Assignment Group
Documentation and metadata improvements.
Attack Mode
Documentation and metadata improvements.
Attack Patterns
Documentation and metadata improvements.
Audit Logs
Documentation and metadata improvements.
Birthday
Documentation and metadata improvements.
Block Indicators Status
Documentation and metadata improvements.
Blocked Action
Documentation and metadata improvements.
Bugtraq
Documentation and metadata improvements.
CVE
Documentation and metadata improvements.
CVE ID
Documentation and metadata improvements.
CVE Published
Documentation and metadata improvements.
CVSS
Documentation and metadata improvements.
CVSS Availability Requirement
Documentation and metadata improvements.
CVSS Collateral Damage Potential
Documentation and metadata improvements.
CVSS Confidentiality Requirement
Documentation and metadata improvements.
CVSS Integrity Requirement
Documentation and metadata improvements.
Caller
Documentation and metadata improvements.
Campaign Name
Documentation and metadata improvements.
Category Count
Documentation and metadata improvements.
Changed
Documentation and metadata improvements.
City
Documentation and metadata improvements.
Classification
Documentation and metadata improvements.
Close Time
Documentation and metadata improvements.
Closing Reason
Documentation and metadata improvements.
Closing User
Documentation and metadata improvements.
Cloud Account ID
Documentation and metadata improvements.
Cloud Instance ID
Documentation and metadata improvements.
Cloud Region List
Documentation and metadata improvements.
Cloud Resource List
Documentation and metadata improvements.
Cloud Service
Documentation and metadata improvements.
Command Line Verdict
Documentation and metadata improvements.
Comment
Documentation and metadata improvements.
Compliance Notes
Documentation and metadata improvements.
Containment SLA
Documentation and metadata improvements.
Cost Center
Documentation and metadata improvements.
Cost Center Code
Documentation and metadata improvements.
Country Code
Documentation and metadata improvements.
Country Code Number
Documentation and metadata improvements.
Critical Assets
Documentation and metadata improvements.
Custom Query Results
Documentation and metadata improvements.
Department
Documentation and metadata improvements.
Dest OS
Documentation and metadata improvements.
Destination Geolocation
Documentation and metadata improvements.
Destination IPV6
Documentation and metadata improvements.
Destination Networks
Documentation and metadata improvements.
Detected Endpoints
Documentation and metadata improvements.
Detected External IPs
Documentation and metadata improvements.
Detected Internal Hosts
Documentation and metadata improvements.
Detection End Time
Documentation and metadata improvements.
Detection ID
Documentation and metadata improvements.
Detection SLA
Documentation and metadata improvements.
Detection URL
Documentation and metadata improvements.
Device External IPs
Documentation and metadata improvements.
Device Hash
Documentation and metadata improvements.
Device Id
Documentation and metadata improvements.
Device Internal IPs
Documentation and metadata improvements.
Device MAC Address
Documentation and metadata improvements.
Device Model
Documentation and metadata improvements.
Device Name
Documentation and metadata improvements.
Device OS Name
Documentation and metadata improvements.
Device OS Version
Documentation and metadata improvements.
Device OU
Documentation and metadata improvements.
Device Status
Documentation and metadata improvements.
Device Time
Documentation and metadata improvements.
Display Name
Documentation and metadata improvements.
Domain Name
Documentation and metadata improvements.
Domain Registrar Abuse Email
Documentation and metadata improvements.
Domain Squatting Result
Documentation and metadata improvements.
Domain Updated Date
Documentation and metadata improvements.
Dsts
Documentation and metadata improvements.
Duration
Documentation and metadata improvements.
Email
Documentation and metadata improvements.
Email Sent Successfully
Documentation and metadata improvements.
EmailCampaignCanvas
Documentation and metadata improvements.
EmailCampaignMutualIndicators
Documentation and metadata improvements.
EmailCampaignSnippets
Documentation and metadata improvements.
EmailCampaignSummary
Documentation and metadata improvements.
Employee Display Name
Documentation and metadata improvements.
Employee Email
Documentation and metadata improvements.
Employee Manager Email
Documentation and metadata improvements.
End Time
Documentation and metadata improvements.
Endpoint Isolation Status
Documentation and metadata improvements.
Endpoints Details
Documentation and metadata improvements.
Error Code
Documentation and metadata improvements.
Error Message
Documentation and metadata improvements.
Escalation
Documentation and metadata improvements.
Event Action
Documentation and metadata improvements.
Event Descriptions
Documentation and metadata improvements.
Event ID
Documentation and metadata improvements.
Event Names
Documentation and metadata improvements.
Exposure Level
Documentation and metadata improvements.
External Category ID
Documentation and metadata improvements.
External Category Name
Documentation and metadata improvements.
External Confidence
Documentation and metadata improvements.
External End Time
Documentation and metadata improvements.
External Last Updated Time
Documentation and metadata improvements.
External Link
Documentation and metadata improvements.
External Severity
Documentation and metadata improvements.
External Start Time
Documentation and metadata improvements.
External Status
Documentation and metadata improvements.
External Sub Category ID
Documentation and metadata improvements.
External Sub Category Name
Documentation and metadata improvements.
External System ID
Documentation and metadata improvements.
Failed Logon Events
Documentation and metadata improvements.
Failed Logon Events Timeframe
Documentation and metadata improvements.
File Access Date
Documentation and metadata improvements.
File Creation Date
Documentation and metadata improvements.
File Hash
Documentation and metadata improvements.
File Relationships
Documentation and metadata improvements.
File SHA1
Documentation and metadata improvements.
File Size
Documentation and metadata improvements.
First Name
Documentation and metadata improvements.
First Seen
Documentation and metadata improvements.
Follow Up
Documentation and metadata improvements.
Full Name
Documentation and metadata improvements.
Given Name
Documentation and metadata improvements.
Group ID
Documentation and metadata improvements.
High Risky Hosts
Documentation and metadata improvements.
High Risky Users
Documentation and metadata improvements.
Hunt Results Count
Documentation and metadata improvements.
IP Blocked Status
Documentation and metadata improvements.
IP Reputation
Documentation and metadata improvements.
Identity Type
Documentation and metadata improvements.
Incident Link
Documentation and metadata improvements.
IncomingMirrorError
Documentation and metadata improvements.
Internal Addresses
Documentation and metadata improvements.
Investigation Stage
Documentation and metadata improvements.
Is Active
Documentation and metadata improvements.
Isolated
Documentation and metadata improvements.
Item Owner
Documentation and metadata improvements.
Item Owner Email
Documentation and metadata improvements.
Job Code
Documentation and metadata improvements.
Job Family
Documentation and metadata improvements.
Job Function
Documentation and metadata improvements.
Last Mirrored Time Stamp
Documentation and metadata improvements.
Last Modified By
Documentation and metadata improvements.
Last Modified On
Documentation and metadata improvements.
Last Name
Documentation and metadata improvements.
Last Seen
Documentation and metadata improvements.
Last Update Time
Documentation and metadata improvements.
Leadership
Documentation and metadata improvements.
List Of Rules - Event
Documentation and metadata improvements.
Location
Documentation and metadata improvements.
Location Region
Documentation and metadata improvements.
Log Source
Documentation and metadata improvements.
Log Source Name
Documentation and metadata improvements.
Log Source Type
Documentation and metadata improvements.
Low Level Categories Events
Documentation and metadata improvements.
MITRE Tactic ID
Documentation and metadata improvements.
MITRE Tactic Name
Documentation and metadata improvements.
MITRE Technique ID
Documentation and metadata improvements.
MITRE Technique Name
Documentation and metadata improvements.
Macro Source Code
Documentation and metadata improvements.
Manager Email Address
Documentation and metadata improvements.
Manager Name
Documentation and metadata improvements.
Mobile Device Model
Documentation and metadata improvements.
Mobile Phone
Documentation and metadata improvements.
Number Of Found Related Alerts
Documentation and metadata improvements.
Number Of Log Sources
Documentation and metadata improvements.
Number of Related Incidents
Documentation and metadata improvements.
Number of similar files
Documentation and metadata improvements.
OS
Documentation and metadata improvements.
OS Type
Documentation and metadata improvements.
Objective
Documentation and metadata improvements.
Operation Name
Documentation and metadata improvements.
Org Level 1
Documentation and metadata improvements.
Org Level 2
Documentation and metadata improvements.
Org Level 3
Documentation and metadata improvements.
Org Unit
Documentation and metadata improvements.
OutgoingMirrorError
Documentation and metadata improvements.
Parent Process CMD
Documentation and metadata improvements.
Parent Process File Path
Documentation and metadata improvements.
Parent Process IDs
Documentation and metadata improvements.
Parent Process MD5
Documentation and metadata improvements.
Parent Process Name
Documentation and metadata improvements.
Parent Process Path
Documentation and metadata improvements.
Parent Process SHA256
Documentation and metadata improvements.
Part of Campaign
Documentation and metadata improvements.
Password Changed Date
Documentation and metadata improvements.
Password Reset Successfully
Documentation and metadata improvements.
Personal Email
Documentation and metadata improvements.
Phone Number
Documentation and metadata improvements.
Policy Actions
Documentation and metadata improvements.
Policy Deleted
Documentation and metadata improvements.
Policy Description
Documentation and metadata improvements.
Policy Details
Documentation and metadata improvements.
Policy ID
Documentation and metadata improvements.
Policy Recommendation
Documentation and metadata improvements.
Policy Remediable
Documentation and metadata improvements.
Policy Severity
Documentation and metadata improvements.
Policy Type
Documentation and metadata improvements.
Policy URI
Documentation and metadata improvements.
Post Nat Destination IP
Documentation and metadata improvements.
Post Nat Destination Port
Documentation and metadata improvements.
Post Nat Source IP
Documentation and metadata improvements.
Post Nat Source Port
Documentation and metadata improvements.
Pre Nat Destination Port
Documentation and metadata improvements.
Pre Nat Source IP
Documentation and metadata improvements.
Pre Nat Source Port
Documentation and metadata improvements.
Process CMD
Documentation and metadata improvements.
Process Creation Time
Documentation and metadata improvements.
Process ID
Documentation and metadata improvements.
Process MD5
Documentation and metadata improvements.
Process Names
Documentation and metadata improvements.
Process Paths
Documentation and metadata improvements.
Process SHA256
Documentation and metadata improvements.
Project ID
Documentation and metadata improvements.
Protocol names
Documentation and metadata improvements.
Rating
Documentation and metadata improvements.
Raw Event
Documentation and metadata improvements.
Referenced Resource ID
Documentation and metadata improvements.
Referenced Resource Name
Documentation and metadata improvements.
Region
Documentation and metadata improvements.
Region ID
Documentation and metadata improvements.
Registration Email
Documentation and metadata improvements.
Registry Hive
Documentation and metadata improvements.
Registry Key
Documentation and metadata improvements.
Registry Value
Documentation and metadata improvements.
Registry Value Type
Documentation and metadata improvements.
Related Alerts
Documentation and metadata improvements.
Related Campaign
Documentation and metadata improvements.
Related Endpoints
Documentation and metadata improvements.
Related Report
Documentation and metadata improvements.
Remediation SLA
Documentation and metadata improvements.
RemovedFromCampaigns
Documentation and metadata improvements.
Rendered HTML
Documentation and metadata improvements.
Report Name
Documentation and metadata improvements.
Reporter Email Address
Documentation and metadata improvements.
Resource Name
Documentation and metadata improvements.
Resource Type
Documentation and metadata improvements.
Resource URL
Documentation and metadata improvements.
Risk Name
Documentation and metadata improvements.
Risk Rating
Documentation and metadata improvements.
Risk Score
Documentation and metadata improvements.
Rule Name
Documentation and metadata improvements.
SHA1
Documentation and metadata improvements.
SHA512
Documentation and metadata improvements.
SKU Name
Documentation and metadata improvements.
SKU TIER
Documentation and metadata improvements.
SSDeep
Documentation and metadata improvements.
Scenario
Documentation and metadata improvements.
Selected Indicators
Documentation and metadata improvements.
Sensor IP
Documentation and metadata improvements.
Signature
Documentation and metadata improvements.
Similar incidents Dbot
Documentation and metadata improvements.
Source Category
Documentation and metadata improvements.
Source Create time
Documentation and metadata improvements.
Source Created By
Documentation and metadata improvements.
Source External IPs
Documentation and metadata improvements.
Source Geolocation
Documentation and metadata improvements.
Source Id
Documentation and metadata improvements.
Source Networks
Documentation and metadata improvements.
Source Priority
Documentation and metadata improvements.
Source Status
Documentation and metadata improvements.
Source Updated by
Documentation and metadata improvements.
Source Urgency
Documentation and metadata improvements.
Src OS
Documentation and metadata improvements.
Start Time
Documentation and metadata improvements.
State
Documentation and metadata improvements.
Status Reason
Documentation and metadata improvements.
Street Address
Documentation and metadata improvements.
String Similarity Results
Documentation and metadata improvements.
Sub Category
Documentation and metadata improvements.
Subtype
Documentation and metadata improvements.
Surname
Documentation and metadata improvements.
Suspicious Executions
Documentation and metadata improvements.
Suspicious Executions Found
Documentation and metadata improvements.
Tactic
Documentation and metadata improvements.
Tactic ID
Documentation and metadata improvements.
Team name
Documentation and metadata improvements.
Technical Owner
Documentation and metadata improvements.
Technical Owner Contact
Documentation and metadata improvements.
Technical User
Documentation and metadata improvements.
Technique
Documentation and metadata improvements.
Technique ID
Documentation and metadata improvements.
Tenant Name
Documentation and metadata improvements.
Threat Family Name
Documentation and metadata improvements.
Threat Name
Documentation and metadata improvements.
Ticket Acknowledged Date
Documentation and metadata improvements.
Ticket Closed Date
Documentation and metadata improvements.
Ticket Number
Documentation and metadata improvements.
Time to Assignment
Documentation and metadata improvements.
Timezone
Documentation and metadata improvements.
Title
Documentation and metadata improvements.
Tool Usage Found
Documentation and metadata improvements.
Tools
Documentation and metadata improvements.
Traffic Direction
Documentation and metadata improvements.
Triage SLA
Documentation and metadata improvements.
Triggered Security Profile
Documentation and metadata improvements.
URL SSL Verification
Documentation and metadata improvements.
URLs
Documentation and metadata improvements.
UUID
Documentation and metadata improvements.
Unique Ports
Documentation and metadata improvements.
Use Case Description
Documentation and metadata improvements.
User Anomaly Count
Documentation and metadata improvements.
User Block Status
Documentation and metadata improvements.
User Creation Time
Documentation and metadata improvements.
User Engagement Response
Documentation and metadata improvements.
User Groups
Documentation and metadata improvements.
User Id
Documentation and metadata improvements.
User SID
Documentation and metadata improvements.
Users Details
Documentation and metadata improvements.
Vendor ID
Documentation and metadata improvements.
Vendor Product
Documentation and metadata improvements.
Verdict
Documentation and metadata improvements.
Verification Method
Documentation and metadata improvements.
Verification Status
Documentation and metadata improvements.
Vulnerability Category
Documentation and metadata improvements.
Vulnerable Product
Documentation and metadata improvements.
Work Phone
Documentation and metadata improvements.
Zip Code
Documentation and metadata improvements.
app channel name
Documentation and metadata improvements.
sAMAccountName
Documentation and metadata improvements.
similarIncidents
Documentation and metadata improvements.
userAccountControl
Documentation and metadata improvements.

Incident Types

Authentication
Documentation and metadata improvements.
C2Communication
Documentation and metadata improvements.
Defacement
Documentation and metadata improvements.
DoS
Documentation and metadata improvements.
Exfiltration
Documentation and metadata improvements.
Exploit
Documentation and metadata improvements.
Hunt
Documentation and metadata improvements.
Indicator Feed
Documentation and metadata improvements.
Job
Documentation and metadata improvements.
Lateral Movement
Documentation and metadata improvements.
Network
Documentation and metadata improvements.
Policy Violation
Documentation and metadata improvements.
Reconnaissance
Documentation and metadata improvements.
Simulation
Documentation and metadata improvements.
UnknownBinary
Documentation and metadata improvements.
Vulnerability
Documentation and metadata improvements.

Indicator Fields

AS Owner

Documentation and metadata improvements.

ASN

Documentation and metadata improvements.

Account Type

Documentation and metadata improvements.

Acquisition Hire

Documentation and metadata improvements.

Action

Documentation and metadata improvements.

Actor

Documentation and metadata improvements.

Admin Country

Documentation and metadata improvements.

Admin Email

Documentation and metadata improvements.

Admin Name

Documentation and metadata improvements.

Admin Phone

Documentation and metadata improvements.

Aliases

Documentation and metadata improvements.

Applications

Documentation and metadata improvements.

Architecture

Documentation and metadata improvements.

Assigned role

Documentation and metadata improvements.

Assigned user

Documentation and metadata improvements.

Associated File Names

Documentation and metadata improvements.

Associations

Documentation and metadata improvements.

Author

Documentation and metadata improvements.

BIOS Version

Documentation and metadata improvements.

Behavior

Documentation and metadata improvements.

Blocked

Documentation and metadata improvements.

CPE

Documentation and metadata improvements.

CVE Description

Documentation and metadata improvements.

CVE Modified

Documentation and metadata improvements.

CVSS

Documentation and metadata improvements.

CVSS Score

Documentation and metadata improvements.

CVSS Table

Documentation and metadata improvements.

CVSS Vector

Documentation and metadata improvements.

CVSS Version

Documentation and metadata improvements.

CVSS3

Documentation and metadata improvements.

Campaign

Documentation and metadata improvements.

Capabilities

Documentation and metadata improvements.

Certificate Names

Documentation and metadata improvements.

Certificate Signature

Documentation and metadata improvements.

Certificate Validation Checks

Documentation and metadata improvements.

Certificates

Documentation and metadata improvements.

City

Documentation and metadata improvements.

Commands

Documentation and metadata improvements.

Community Notes

Documentation and metadata improvements.

Confidence

Documentation and metadata improvements.

Cost Center

Documentation and metadata improvements.

Cost Center Code

Documentation and metadata improvements.

Country Code

Documentation and metadata improvements.

Country Code Number

Documentation and metadata improvements.

Country Name

Documentation and metadata improvements.

Creation Date

Documentation and metadata improvements.

DHCP Server

Documentation and metadata improvements.

DNS

Documentation and metadata improvements.

DNS Records

Documentation and metadata improvements.

Definition

Documentation and metadata improvements.

Department

Documentation and metadata improvements.

Description

Documentation and metadata improvements.

Detection Engines

Documentation and metadata improvements.

Detections

Documentation and metadata improvements.

Device Model

Documentation and metadata improvements.

Display Name

Documentation and metadata improvements.

Domain IDN Name

Documentation and metadata improvements.

Domain Name

Documentation and metadata improvements.

Domain Referring IPs

Documentation and metadata improvements.

Domain Referring Subnets

Documentation and metadata improvements.

Domain Status

Documentation and metadata improvements.

Domains

Documentation and metadata improvements.

Download URL

Documentation and metadata improvements.

Email

Documentation and metadata improvements.

Email Address

Documentation and metadata improvements.

Entry ID

Documentation and metadata improvements.

Expiration Date

Documentation and metadata improvements.

Extension

Documentation and metadata improvements.

Documentation and metadata improvements.

File Extension

Documentation and metadata improvements.

File Type

Documentation and metadata improvements.

First Seen By Source

Documentation and metadata improvements.

Force Sync

Documentation and metadata improvements.

Geo Country

Documentation and metadata improvements.

Geo Location

Documentation and metadata improvements.

Given Name

Documentation and metadata improvements.

Global Prevalence

Documentation and metadata improvements.

Goals

Documentation and metadata improvements.

Groups

Documentation and metadata improvements.

Hostname

Documentation and metadata improvements.

IP Address

Documentation and metadata improvements.

Identity class

Documentation and metadata improvements.

Implementation Languages

Documentation and metadata improvements.

Indicator Identification

Documentation and metadata improvements.

Industry sectors

Documentation and metadata improvements.

Infrastructure Types

Documentation and metadata improvements.

Internal

Documentation and metadata improvements.

Is Malware Family

Documentation and metadata improvements.

Is Processed

Documentation and metadata improvements.

Issuer

Documentation and metadata improvements.

Issuer DN

Documentation and metadata improvements.

Job Code

Documentation and metadata improvements.

Job Family

Documentation and metadata improvements.

Job Function

Documentation and metadata improvements.

Key Value

Documentation and metadata improvements.

Kill Chain Phases

Documentation and metadata improvements.

Languages

Documentation and metadata improvements.

Last Seen By Source

Documentation and metadata improvements.

Leadership

Documentation and metadata improvements.

Location

Documentation and metadata improvements.

Location Region

Documentation and metadata improvements.

MD5

Documentation and metadata improvements.

Malware Family

Documentation and metadata improvements.

Malware types

Documentation and metadata improvements.

Manager Email Address

Documentation and metadata improvements.

Manager Name

Documentation and metadata improvements.

Memory

Documentation and metadata improvements.

Mitre ID

Documentation and metadata improvements.

Mitre Tactics

Documentation and metadata improvements.

Mobile Phone

Documentation and metadata improvements.

Name

Documentation and metadata improvements.

Name Field

Documentation and metadata improvements.

Name Servers

Documentation and metadata improvements.

Number of subkeys

Documentation and metadata improvements.

OS Version

Documentation and metadata improvements.

Objective

Documentation and metadata improvements.

Office365Category

Documentation and metadata improvements.

Office365ExpressRoute

Documentation and metadata improvements.

Office365Required

Documentation and metadata improvements.

Operating System

Documentation and metadata improvements.

Operating System Refs

Documentation and metadata improvements.

Operating System Version

Documentation and metadata improvements.

Org Level 1

Documentation and metadata improvements.

Org Level 2

Documentation and metadata improvements.

Org Level 3

Documentation and metadata improvements.

Org Unit

Documentation and metadata improvements.

Organization

Documentation and metadata improvements.

Organization First Seen

Documentation and metadata improvements.

Organization Last Seen

Documentation and metadata improvements.

Organization Prevalence

Documentation and metadata improvements.

Organization Type

Documentation and metadata improvements.

Organizational Unit (OU)

Documentation and metadata improvements.

PEM

Documentation and metadata improvements.

Path

Documentation and metadata improvements.

Paths

Documentation and metadata improvements.

Personal Email

Documentation and metadata improvements.

Port

Documentation and metadata improvements.

Positive Detections

Documentation and metadata improvements.

Primary Motivation

Documentation and metadata improvements.

Processor

Documentation and metadata improvements.

Processors

Documentation and metadata improvements.

Product

Documentation and metadata improvements.

Public Key

Documentation and metadata improvements.

Publications

Documentation and metadata improvements.

Published

Documentation and metadata improvements.

Quarantined

Documentation and metadata improvements.

Query Language

Documentation and metadata improvements.

Rank

Documentation and metadata improvements.

Region

Documentation and metadata improvements.

Registrant Country

Documentation and metadata improvements.

Registrant Email

Documentation and metadata improvements.

Registrant Name

Documentation and metadata improvements.

Registrant Phone

Documentation and metadata improvements.

Registrar Abuse Address

Documentation and metadata improvements.

Registrar Abuse Country

Documentation and metadata improvements.

Registrar Abuse Email

Documentation and metadata improvements.

Registrar Abuse Name

Documentation and metadata improvements.

Registrar Abuse Network

Documentation and metadata improvements.

Registrar Abuse Phone

Documentation and metadata improvements.

Registrar Name

Documentation and metadata improvements.

Report Object References

Documentation and metadata improvements.

Report type

Documentation and metadata improvements.

Reported By

Documentation and metadata improvements.

Reports

Documentation and metadata improvements.

Resource Level

Documentation and metadata improvements.

Roles

Documentation and metadata improvements.

SHA1

Documentation and metadata improvements.

SHA256

Documentation and metadata improvements.

SHA512

Documentation and metadata improvements.

SPKI SHA256

Documentation and metadata improvements.

SSDeep

Documentation and metadata improvements.

STIX Aliases

Documentation and metadata improvements.

STIX Description

Documentation and metadata improvements.

STIX Goals

Documentation and metadata improvements.

STIX ID

Documentation and metadata improvements.

STIX Is Malware Family

Documentation and metadata improvements.

STIX Kill Chain Phases

Documentation and metadata improvements.

STIX Malware Types

Documentation and metadata improvements.

STIX Primary Motivation.

Documentation and metadata improvements.

STIX Resource Level

Documentation and metadata improvements.

STIX Roles

Documentation and metadata improvements.

STIX Secondary Motivations

Documentation and metadata improvements.

STIX Sophistication

Documentation and metadata improvements.

STIX Threat Actor Types

Documentation and metadata improvements.

STIX Tool Types

Documentation and metadata improvements.

STIX Tool Version

Documentation and metadata improvements.

SWID

Documentation and metadata improvements.

Samples

Documentation and metadata improvements.

Secondary Motivations

Documentation and metadata improvements.

Serial Number

Documentation and metadata improvements.

Service

Documentation and metadata improvements.

Short Description

Documentation and metadata improvements.

Signature Algorithm

Documentation and metadata improvements.

Signature Authentihash

Documentation and metadata improvements.

Signature Copyright

Documentation and metadata improvements.

Signature Description

Documentation and metadata improvements.

Signature File Version

Documentation and metadata improvements.

Signature Internal Name

Documentation and metadata improvements.

Signature Original Name

Documentation and metadata improvements.

Signed

Documentation and metadata improvements.

Size

Documentation and metadata improvements.

Sophistication

Documentation and metadata improvements.

Source Original Severity

Documentation and metadata improvements.

Source Priority

Documentation and metadata improvements.

State

Documentation and metadata improvements.

Street Address

Documentation and metadata improvements.

Subdomains

Documentation and metadata improvements.

Subject

Documentation and metadata improvements.

Subject Alternative Names

Documentation and metadata improvements.

Subject DN

Documentation and metadata improvements.

Surname

Documentation and metadata improvements.

Targets

Documentation and metadata improvements.

Threat Actor Types

Documentation and metadata improvements.

Threat Types

Documentation and metadata improvements.

Title

Documentation and metadata improvements.

Tool Types

Documentation and metadata improvements.

Tool Version

Documentation and metadata improvements.

Traffic Light Protocol

Documentation and metadata improvements.

Updated Date

Documentation and metadata improvements.

User ID

Documentation and metadata improvements.

Username

Documentation and metadata improvements.

Validity Not After

Documentation and metadata improvements.

Validity Not Before

Documentation and metadata improvements.

Vendor

Documentation and metadata improvements.

Version

Documentation and metadata improvements.

Vulnerabilities

Documentation and metadata improvements.

Vulnerable Products

Documentation and metadata improvements.

Whois Records

Documentation and metadata improvements.

Work Phone

Documentation and metadata improvements.

X.509 v3 Extensions

Documentation and metadata improvements.

Zip Code

Documentation and metadata improvements.

imphash

Documentation and metadata improvements.

Indicator Types

ASN
Documentation and metadata improvements.
Account
Documentation and metadata improvements.
Attack Pattern
Documentation and metadata improvements.
CIDR
Documentation and metadata improvements.
CVE
Documentation and metadata improvements.
Campaign
Documentation and metadata improvements.
Course of Action
Documentation and metadata improvements.
DomainGlob
Documentation and metadata improvements.
Email
Documentation and metadata improvements.
File MD5
Documentation and metadata improvements.
File SHA-1
Documentation and metadata improvements.
File SHA-256
Documentation and metadata improvements.
Host
Documentation and metadata improvements.
IPv6CIDR
Documentation and metadata improvements.
Identity
Documentation and metadata improvements.
Infrastructure
Documentation and metadata improvements.
Intrusion Set
Documentation and metadata improvements.
Location
Documentation and metadata improvements.
Malware
Documentation and metadata improvements.
Mutex
Documentation and metadata improvements.
Onion Address
Documentation and metadata improvements.
Registry Key
Documentation and metadata improvements.
Report
Documentation and metadata improvements.
Software
Documentation and metadata improvements.
Tactic
Documentation and metadata improvements.
Threat Actor
Documentation and metadata improvements.
Tool
Documentation and metadata improvements.
X509 Certificate
Documentation and metadata improvements.
ssdeep
Documentation and metadata improvements.
Domain
Added support for the xti module.
File
Added support for the xti module.
IP
Added support for the xti module.
IPv6
Added support for the xti module.
URL
Added support for the xti module.

Layouts

ASN
Documentation and metadata improvements.
Account Indicator
Documentation and metadata improvements.
Attack Pattern
Documentation and metadata improvements.
CVE Indicator
Documentation and metadata improvements.
Campaign
Documentation and metadata improvements.
Course of Action
Documentation and metadata improvements.
Domain Indicator
Documentation and metadata improvements.
Email Indicator
Documentation and metadata improvements.
File Indicator
Documentation and metadata improvements.
Host Indicator
Documentation and metadata improvements.
IP Indicator
Documentation and metadata improvements.
Identity
Documentation and metadata improvements.
Indicator Feed Incident
Documentation and metadata improvements.
Infrastructure
Documentation and metadata improvements.
Intrusion Set
Documentation and metadata improvements.
Location
Documentation and metadata improvements.
Malware Indicator
Documentation and metadata improvements.
Mutex
Documentation and metadata improvements.
Registry Key Indicator
Documentation and metadata improvements.
Report
Documentation and metadata improvements.
Software
Documentation and metadata improvements.
Tactic Layout
Documentation and metadata improvements.
Threat Actor
Documentation and metadata improvements.
Tool Indicator
Documentation and metadata improvements.
URL Indicator
Documentation and metadata improvements.
Vulnerability Incident
Documentation and metadata improvements.
X509 Certificate
Documentation and metadata improvements.

Mappers

Mail Listener - Incoming Mapper

Documentation and metadata improvements.

Related pull requests:
- 45355

Download

3.10.13 - 10750492 (July 5, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44960

Download

3.10.12 - 10424072 (June 24, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44564

Download

3.10.11 - 9233795 (May 24, 2026)

Incident Fields

Last Update Time
Added the CrowdStrike Falcon IOA Event incident type to the associated types of the Last Update Time incident field.

Related pull requests:
- 44334

Download

3.10.10 - 8801294 (May 6, 2026)

Layouts

URL Indicator
Updated Add tags and Remove tags in the URL Indicator layout to use a pipe (|) delimiter.

Related pull requests:
- 44206

Download

3.10.9 - 8727847 (May 4, 2026)

Indicator Types

IPv6
Fixed an issue where IPv6 indicators with a trailing :: (for example, aaaa:9999:1111:ffff::) were not extracted.

Related pull requests:
- 44112

Download

3.10.8 - 8382811 (April 20, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43976

Download

3.10.7 - 8288718 (April 15, 2026)

Indicator Types

Domain
Fixed an issue where false-positive domain indicators were extracted.

Related pull requests:
- 43856

Download

3.10.6 - 8227525 (April 13, 2026)

Incident Fields

Last Update Time
Updated the Last Update Time incident field to support the CrowdStrike Falcon Intelligence Recon incident type.

Related pull requests:
- 42097
- 41869

Download

3.10.5 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43567

Download

3.10.4 - 7478701 (March 8, 2026)

Incident Fields

Last Update Time
Added the GravityZone EDR, and GravityZone XDR incident types as associated types.

Related pull requests:
- 43387
- 42789

Download

3.10.3 - 7389211 (March 1, 2026)

Indicator Types

IPv6
Fixed an issue where the IPv6 indicator type regex failed to extract an IPv6 address from input text containing line breaks.

Related pull requests:
- 43284

Download

3.10.2 - 7188558 (February 17, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43146

Download

3.10.1 - 6920594 (January 28, 2026)

Incident Fields

Traffic Direction
Updated the Traffic Direction incident field to associate 'Trellix Incident' type.
Alert Attack Time
Updated the Alert Attack Time incident field to associate 'Trellix Incident' type.
Vendor Product
Updated the Vendor Product incident field to associate 'Trellix Incident' type.
UUID
Updated the UUID incident field to associate 'Trellix Incident' type.

Related pull requests:
- 42762

Download

3.10.0 - 6802612 (January 20, 2026)

Incident Fields

Detected External Hosts
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Vendor Product
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Last Update Time
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
UUID
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
End Time
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Display Name
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Start Time
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Source IPs
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Risk Score
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Detection ID
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.

Related pull requests:
- 42537

Download

3.9.9 - 6640287 (January 11, 2026)

Indicator Types

URL
Updated the URL indicator regex to handle defanged IP addresses with a [.] notation (e.g., 45.134.174[.]235/2.sh).

Related pull requests:
- 42595

Download

3.9.8 - 6580350 (January 6, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 42564

Download

3.9.7 - 5888286 (November 16, 2025)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41916

Download

3.9.6 - 5538136 (October 23, 2025)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41627

Download

3.10.17 - 13782934 (October 14, 2026)

Documentation and metadata improvements.

Related pull requests:
- 46240

Download

3.10.16 - 13710525 (October 11, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 46192

Download

3.10.15 - R13599546 (October 7, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45412

Download

3.10.14 - 11786168 (August 9, 2026)

Classifiers

Mail Listener - Classifier

Documentation and metadata improvements.

Incident Fields

ASN
Documentation and metadata improvements.
ASN Name
Documentation and metadata improvements.
Account ID
Documentation and metadata improvements.
Account Member Of
Documentation and metadata improvements.
Account Status
Documentation and metadata improvements.
Acquisition Hire
Documentation and metadata improvements.
Additional Data
Documentation and metadata improvements.
Additional Email Addresses
Documentation and metadata improvements.
Additional Indicators
Documentation and metadata improvements.
Affected Hosts
Documentation and metadata improvements.
Affected Users
Documentation and metadata improvements.
Agent Version
Documentation and metadata improvements.
Agents ID
Documentation and metadata improvements.
Alert Acknowledgement
Documentation and metadata improvements.
Alert Action
Documentation and metadata improvements.
Alert Malicious
Documentation and metadata improvements.
Alert Rules
Documentation and metadata improvements.
Alert Type ID
Documentation and metadata improvements.
Alert tags
Documentation and metadata improvements.
App message
Documentation and metadata improvements.
Application Path
Documentation and metadata improvements.
Approval Status
Documentation and metadata improvements.
Approver
Documentation and metadata improvements.
Asset ID
Documentation and metadata improvements.
Asset Name
Documentation and metadata improvements.
Assigned User
Documentation and metadata improvements.
Assignment Group
Documentation and metadata improvements.
Attack Mode
Documentation and metadata improvements.
Attack Patterns
Documentation and metadata improvements.
Audit Logs
Documentation and metadata improvements.
Birthday
Documentation and metadata improvements.
Block Indicators Status
Documentation and metadata improvements.
Blocked Action
Documentation and metadata improvements.
Bugtraq
Documentation and metadata improvements.
CVE
Documentation and metadata improvements.
CVE ID
Documentation and metadata improvements.
CVE Published
Documentation and metadata improvements.
CVSS
Documentation and metadata improvements.
CVSS Availability Requirement
Documentation and metadata improvements.
CVSS Collateral Damage Potential
Documentation and metadata improvements.
CVSS Confidentiality Requirement
Documentation and metadata improvements.
CVSS Integrity Requirement
Documentation and metadata improvements.
Caller
Documentation and metadata improvements.
Campaign Name
Documentation and metadata improvements.
Category Count
Documentation and metadata improvements.
Changed
Documentation and metadata improvements.
City
Documentation and metadata improvements.
Classification
Documentation and metadata improvements.
Close Time
Documentation and metadata improvements.
Closing Reason
Documentation and metadata improvements.
Closing User
Documentation and metadata improvements.
Cloud Account ID
Documentation and metadata improvements.
Cloud Instance ID
Documentation and metadata improvements.
Cloud Region List
Documentation and metadata improvements.
Cloud Resource List
Documentation and metadata improvements.
Cloud Service
Documentation and metadata improvements.
Command Line Verdict
Documentation and metadata improvements.
Comment
Documentation and metadata improvements.
Compliance Notes
Documentation and metadata improvements.
Containment SLA
Documentation and metadata improvements.
Cost Center
Documentation and metadata improvements.
Cost Center Code
Documentation and metadata improvements.
Country Code
Documentation and metadata improvements.
Country Code Number
Documentation and metadata improvements.
Critical Assets
Documentation and metadata improvements.
Custom Query Results
Documentation and metadata improvements.
Department
Documentation and metadata improvements.
Dest OS
Documentation and metadata improvements.
Destination Geolocation
Documentation and metadata improvements.
Destination IPV6
Documentation and metadata improvements.
Destination Networks
Documentation and metadata improvements.
Detected Endpoints
Documentation and metadata improvements.
Detected External IPs
Documentation and metadata improvements.
Detected Internal Hosts
Documentation and metadata improvements.
Detection End Time
Documentation and metadata improvements.
Detection ID
Documentation and metadata improvements.
Detection SLA
Documentation and metadata improvements.
Detection URL
Documentation and metadata improvements.
Device External IPs
Documentation and metadata improvements.
Device Hash
Documentation and metadata improvements.
Device Id
Documentation and metadata improvements.
Device Internal IPs
Documentation and metadata improvements.
Device MAC Address
Documentation and metadata improvements.
Device Model
Documentation and metadata improvements.
Device Name
Documentation and metadata improvements.
Device OS Name
Documentation and metadata improvements.
Device OS Version
Documentation and metadata improvements.
Device OU
Documentation and metadata improvements.
Device Status
Documentation and metadata improvements.
Device Time
Documentation and metadata improvements.
Display Name
Documentation and metadata improvements.
Domain Name
Documentation and metadata improvements.
Domain Registrar Abuse Email
Documentation and metadata improvements.
Domain Squatting Result
Documentation and metadata improvements.
Domain Updated Date
Documentation and metadata improvements.
Dsts
Documentation and metadata improvements.
Duration
Documentation and metadata improvements.
Email
Documentation and metadata improvements.
Email Sent Successfully
Documentation and metadata improvements.
EmailCampaignCanvas
Documentation and metadata improvements.
EmailCampaignMutualIndicators
Documentation and metadata improvements.
EmailCampaignSnippets
Documentation and metadata improvements.
EmailCampaignSummary
Documentation and metadata improvements.
Employee Display Name
Documentation and metadata improvements.
Employee Email
Documentation and metadata improvements.
Employee Manager Email
Documentation and metadata improvements.
End Time
Documentation and metadata improvements.
Endpoint Isolation Status
Documentation and metadata improvements.
Endpoints Details
Documentation and metadata improvements.
Error Code
Documentation and metadata improvements.
Error Message
Documentation and metadata improvements.
Escalation
Documentation and metadata improvements.
Event Action
Documentation and metadata improvements.
Event Descriptions
Documentation and metadata improvements.
Event ID
Documentation and metadata improvements.
Event Names
Documentation and metadata improvements.
Exposure Level
Documentation and metadata improvements.
External Category ID
Documentation and metadata improvements.
External Category Name
Documentation and metadata improvements.
External Confidence
Documentation and metadata improvements.
External End Time
Documentation and metadata improvements.
External Last Updated Time
Documentation and metadata improvements.
External Link
Documentation and metadata improvements.
External Severity
Documentation and metadata improvements.
External Start Time
Documentation and metadata improvements.
External Status
Documentation and metadata improvements.
External Sub Category ID
Documentation and metadata improvements.
External Sub Category Name
Documentation and metadata improvements.
External System ID
Documentation and metadata improvements.
Failed Logon Events
Documentation and metadata improvements.
Failed Logon Events Timeframe
Documentation and metadata improvements.
File Access Date
Documentation and metadata improvements.
File Creation Date
Documentation and metadata improvements.
File Hash
Documentation and metadata improvements.
File Relationships
Documentation and metadata improvements.
File SHA1
Documentation and metadata improvements.
File Size
Documentation and metadata improvements.
First Name
Documentation and metadata improvements.
First Seen
Documentation and metadata improvements.
Follow Up
Documentation and metadata improvements.
Full Name
Documentation and metadata improvements.
Given Name
Documentation and metadata improvements.
Group ID
Documentation and metadata improvements.
High Risky Hosts
Documentation and metadata improvements.
High Risky Users
Documentation and metadata improvements.
Hunt Results Count
Documentation and metadata improvements.
IP Blocked Status
Documentation and metadata improvements.
IP Reputation
Documentation and metadata improvements.
Identity Type
Documentation and metadata improvements.
Incident Link
Documentation and metadata improvements.
IncomingMirrorError
Documentation and metadata improvements.
Internal Addresses
Documentation and metadata improvements.
Investigation Stage
Documentation and metadata improvements.
Is Active
Documentation and metadata improvements.
Isolated
Documentation and metadata improvements.
Item Owner
Documentation and metadata improvements.
Item Owner Email
Documentation and metadata improvements.
Job Code
Documentation and metadata improvements.
Job Family
Documentation and metadata improvements.
Job Function
Documentation and metadata improvements.
Last Mirrored Time Stamp
Documentation and metadata improvements.
Last Modified By
Documentation and metadata improvements.
Last Modified On
Documentation and metadata improvements.
Last Name
Documentation and metadata improvements.
Last Seen
Documentation and metadata improvements.
Last Update Time
Documentation and metadata improvements.
Leadership
Documentation and metadata improvements.
List Of Rules - Event
Documentation and metadata improvements.
Location
Documentation and metadata improvements.
Location Region
Documentation and metadata improvements.
Log Source
Documentation and metadata improvements.
Log Source Name
Documentation and metadata improvements.
Log Source Type
Documentation and metadata improvements.
Low Level Categories Events
Documentation and metadata improvements.
MITRE Tactic ID
Documentation and metadata improvements.
MITRE Tactic Name
Documentation and metadata improvements.
MITRE Technique ID
Documentation and metadata improvements.
MITRE Technique Name
Documentation and metadata improvements.
Macro Source Code
Documentation and metadata improvements.
Manager Email Address
Documentation and metadata improvements.
Manager Name
Documentation and metadata improvements.
Mobile Device Model
Documentation and metadata improvements.
Mobile Phone
Documentation and metadata improvements.
Number Of Found Related Alerts
Documentation and metadata improvements.
Number Of Log Sources
Documentation and metadata improvements.
Number of Related Incidents
Documentation and metadata improvements.
Number of similar files
Documentation and metadata improvements.
OS
Documentation and metadata improvements.
OS Type
Documentation and metadata improvements.
Objective
Documentation and metadata improvements.
Operation Name
Documentation and metadata improvements.
Org Level 1
Documentation and metadata improvements.
Org Level 2
Documentation and metadata improvements.
Org Level 3
Documentation and metadata improvements.
Org Unit
Documentation and metadata improvements.
Original Alert ID
Documentation and metadata improvements.
Original Alert Name
Documentation and metadata improvements.
Original Alert Source
Documentation and metadata improvements.
Original Description
Documentation and metadata improvements.
Original Events
Documentation and metadata improvements.
OutgoingMirrorError
Documentation and metadata improvements.
Parent Process CMD
Documentation and metadata improvements.
Parent Process File Path
Documentation and metadata improvements.
Parent Process IDs
Documentation and metadata improvements.
Parent Process MD5
Documentation and metadata improvements.
Parent Process Name
Documentation and metadata improvements.
Parent Process Path
Documentation and metadata improvements.
Parent Process SHA256
Documentation and metadata improvements.
Part of Campaign
Documentation and metadata improvements.
Password Changed Date
Documentation and metadata improvements.
Password Reset Successfully
Documentation and metadata improvements.
Personal Email
Documentation and metadata improvements.
Phone Number
Documentation and metadata improvements.
Policy Actions
Documentation and metadata improvements.
Policy Deleted
Documentation and metadata improvements.
Policy Description
Documentation and metadata improvements.
Policy Details
Documentation and metadata improvements.
Policy ID
Documentation and metadata improvements.
Policy Recommendation
Documentation and metadata improvements.
Policy Remediable
Documentation and metadata improvements.
Policy Severity
Documentation and metadata improvements.
Policy Type
Documentation and metadata improvements.
Policy URI
Documentation and metadata improvements.
Post Nat Destination IP
Documentation and metadata improvements.
Post Nat Destination Port
Documentation and metadata improvements.
Post Nat Source IP
Documentation and metadata improvements.
Post Nat Source Port
Documentation and metadata improvements.
Pre Nat Destination Port
Documentation and metadata improvements.
Pre Nat Source IP
Documentation and metadata improvements.
Pre Nat Source Port
Documentation and metadata improvements.
Process CMD
Documentation and metadata improvements.
Process Creation Time
Documentation and metadata improvements.
Process ID
Documentation and metadata improvements.
Process MD5
Documentation and metadata improvements.
Process Names
Documentation and metadata improvements.
Process Paths
Documentation and metadata improvements.
Process SHA256
Documentation and metadata improvements.
Project ID
Documentation and metadata improvements.
Protocol names
Documentation and metadata improvements.
Rating
Documentation and metadata improvements.
Raw Event
Documentation and metadata improvements.
Referenced Resource ID
Documentation and metadata improvements.
Referenced Resource Name
Documentation and metadata improvements.
Region
Documentation and metadata improvements.
Region ID
Documentation and metadata improvements.
Registration Email
Documentation and metadata improvements.
Registry Hive
Documentation and metadata improvements.
Registry Key
Documentation and metadata improvements.
Registry Value
Documentation and metadata improvements.
Registry Value Type
Documentation and metadata improvements.
Related Alerts
Documentation and metadata improvements.
Related Campaign
Documentation and metadata improvements.
Related Endpoints
Documentation and metadata improvements.
Related Report
Documentation and metadata improvements.
Remediation SLA
Documentation and metadata improvements.
RemovedFromCampaigns
Documentation and metadata improvements.
Rendered HTML
Documentation and metadata improvements.
Report Name
Documentation and metadata improvements.
Reporter Email Address
Documentation and metadata improvements.
Resource Name
Documentation and metadata improvements.
Resource Type
Documentation and metadata improvements.
Resource URL
Documentation and metadata improvements.
Risk Name
Documentation and metadata improvements.
Risk Rating
Documentation and metadata improvements.
Risk Score
Documentation and metadata improvements.
Rule Name
Documentation and metadata improvements.
SHA1
Documentation and metadata improvements.
SHA512
Documentation and metadata improvements.
SKU Name
Documentation and metadata improvements.
SKU TIER
Documentation and metadata improvements.
SSDeep
Documentation and metadata improvements.
Scenario
Documentation and metadata improvements.
Selected Indicators
Documentation and metadata improvements.
Sensor IP
Documentation and metadata improvements.
Signature
Documentation and metadata improvements.
Similar incidents Dbot
Documentation and metadata improvements.
Source Category
Documentation and metadata improvements.
Source Create time
Documentation and metadata improvements.
Source Created By
Documentation and metadata improvements.
Source External IPs
Documentation and metadata improvements.
Source Geolocation
Documentation and metadata improvements.
Source Id
Documentation and metadata improvements.
Source Networks
Documentation and metadata improvements.
Source Priority
Documentation and metadata improvements.
Source Status
Documentation and metadata improvements.
Source Updated by
Documentation and metadata improvements.
Source Urgency
Documentation and metadata improvements.
Src OS
Documentation and metadata improvements.
Start Time
Documentation and metadata improvements.
State
Documentation and metadata improvements.
Status Reason
Documentation and metadata improvements.
Street Address
Documentation and metadata improvements.
String Similarity Results
Documentation and metadata improvements.
Sub Category
Documentation and metadata improvements.
Subtype
Documentation and metadata improvements.
Surname
Documentation and metadata improvements.
Suspicious Executions
Documentation and metadata improvements.
Suspicious Executions Found
Documentation and metadata improvements.
Tactic
Documentation and metadata improvements.
Tactic ID
Documentation and metadata improvements.
Team name
Documentation and metadata improvements.
Technical Owner
Documentation and metadata improvements.
Technical Owner Contact
Documentation and metadata improvements.
Technical User
Documentation and metadata improvements.
Technique
Documentation and metadata improvements.
Technique ID
Documentation and metadata improvements.
Tenant Name
Documentation and metadata improvements.
Threat Family Name
Documentation and metadata improvements.
Threat Name
Documentation and metadata improvements.
Ticket Acknowledged Date
Documentation and metadata improvements.
Ticket Closed Date
Documentation and metadata improvements.
Ticket Number
Documentation and metadata improvements.
Time to Assignment
Documentation and metadata improvements.
Timezone
Documentation and metadata improvements.
Title
Documentation and metadata improvements.
Tool Usage Found
Documentation and metadata improvements.
Tools
Documentation and metadata improvements.
Traffic Direction
Documentation and metadata improvements.
Triage SLA
Documentation and metadata improvements.
Triggered Security Profile
Documentation and metadata improvements.
URL SSL Verification
Documentation and metadata improvements.
URLs
Documentation and metadata improvements.
UUID
Documentation and metadata improvements.
Unique Ports
Documentation and metadata improvements.
Use Case Description
Documentation and metadata improvements.
User Anomaly Count
Documentation and metadata improvements.
User Block Status
Documentation and metadata improvements.
User Creation Time
Documentation and metadata improvements.
User Engagement Response
Documentation and metadata improvements.
User Groups
Documentation and metadata improvements.
User Id
Documentation and metadata improvements.
User SID
Documentation and metadata improvements.
Users Details
Documentation and metadata improvements.
Vendor ID
Documentation and metadata improvements.
Vendor Product
Documentation and metadata improvements.
Verdict
Documentation and metadata improvements.
Verification Method
Documentation and metadata improvements.
Verification Status
Documentation and metadata improvements.
Vulnerability Category
Documentation and metadata improvements.
Vulnerable Product
Documentation and metadata improvements.
Work Phone
Documentation and metadata improvements.
Zip Code
Documentation and metadata improvements.
app channel name
Documentation and metadata improvements.
sAMAccountName
Documentation and metadata improvements.
similarIncidents
Documentation and metadata improvements.
userAccountControl
Documentation and metadata improvements.

Incident Types

Authentication
Documentation and metadata improvements.
C2Communication
Documentation and metadata improvements.
Defacement
Documentation and metadata improvements.
DoS
Documentation and metadata improvements.
Exfiltration
Documentation and metadata improvements.
Exploit
Documentation and metadata improvements.
Hunt
Documentation and metadata improvements.
Indicator Feed
Documentation and metadata improvements.
Job
Documentation and metadata improvements.
Lateral Movement
Documentation and metadata improvements.
Network
Documentation and metadata improvements.
Policy Violation
Documentation and metadata improvements.
Reconnaissance
Documentation and metadata improvements.
Simulation
Documentation and metadata improvements.
UnknownBinary
Documentation and metadata improvements.
Vulnerability
Documentation and metadata improvements.

Indicator Fields

AS Owner

Documentation and metadata improvements.

ASN

Documentation and metadata improvements.

Account Type

Documentation and metadata improvements.

Acquisition Hire

Documentation and metadata improvements.

Action

Documentation and metadata improvements.

Actor

Documentation and metadata improvements.

Admin Country

Documentation and metadata improvements.

Admin Email

Documentation and metadata improvements.

Admin Name

Documentation and metadata improvements.

Admin Phone

Documentation and metadata improvements.

Aliases

Documentation and metadata improvements.

Applications

Documentation and metadata improvements.

Architecture

Documentation and metadata improvements.

Assigned role

Documentation and metadata improvements.

Assigned user

Documentation and metadata improvements.

Associated File Names

Documentation and metadata improvements.

Associations

Documentation and metadata improvements.

Author

Documentation and metadata improvements.

BIOS Version

Documentation and metadata improvements.

Behavior

Documentation and metadata improvements.

Blocked

Documentation and metadata improvements.

CPE

Documentation and metadata improvements.

CVE Description

Documentation and metadata improvements.

CVE Modified

Documentation and metadata improvements.

CVSS

Documentation and metadata improvements.

CVSS Score

Documentation and metadata improvements.

CVSS Table

Documentation and metadata improvements.

CVSS Vector

Documentation and metadata improvements.

CVSS Version

Documentation and metadata improvements.

CVSS3

Documentation and metadata improvements.

Campaign

Documentation and metadata improvements.

Capabilities

Documentation and metadata improvements.

Certificate Names

Documentation and metadata improvements.

Certificate Signature

Documentation and metadata improvements.

Certificate Validation Checks

Documentation and metadata improvements.

Certificates

Documentation and metadata improvements.

City

Documentation and metadata improvements.

Commands

Documentation and metadata improvements.

Community Notes

Documentation and metadata improvements.

Confidence

Documentation and metadata improvements.

Cost Center

Documentation and metadata improvements.

Cost Center Code

Documentation and metadata improvements.

Country Code

Documentation and metadata improvements.

Country Code Number

Documentation and metadata improvements.

Country Name

Documentation and metadata improvements.

Creation Date

Documentation and metadata improvements.

DHCP Server

Documentation and metadata improvements.

DNS

Documentation and metadata improvements.

DNS Records

Documentation and metadata improvements.

Definition

Documentation and metadata improvements.

Department

Documentation and metadata improvements.

Description

Documentation and metadata improvements.

Detection Engines

Documentation and metadata improvements.

Detections

Documentation and metadata improvements.

Device Model

Documentation and metadata improvements.

Display Name

Documentation and metadata improvements.

Domain IDN Name

Documentation and metadata improvements.

Domain Name

Documentation and metadata improvements.

Domain Referring IPs

Documentation and metadata improvements.

Domain Referring Subnets

Documentation and metadata improvements.

Domain Status

Documentation and metadata improvements.

Domains

Documentation and metadata improvements.

Download URL

Documentation and metadata improvements.

Email

Documentation and metadata improvements.

Email Address

Documentation and metadata improvements.

Entry ID

Documentation and metadata improvements.

Expiration Date

Documentation and metadata improvements.

Extension

Documentation and metadata improvements.

Documentation and metadata improvements.

File Extension

Documentation and metadata improvements.

File Type

Documentation and metadata improvements.

First Seen By Source

Documentation and metadata improvements.

Force Sync

Documentation and metadata improvements.

Geo Country

Documentation and metadata improvements.

Geo Location

Documentation and metadata improvements.

Given Name

Documentation and metadata improvements.

Global Prevalence

Documentation and metadata improvements.

Goals

Documentation and metadata improvements.

Groups

Documentation and metadata improvements.

Hostname

Documentation and metadata improvements.

IP Address

Documentation and metadata improvements.

Identity class

Documentation and metadata improvements.

Implementation Languages

Documentation and metadata improvements.

Indicator Identification

Documentation and metadata improvements.

Industry sectors

Documentation and metadata improvements.

Infrastructure Types

Documentation and metadata improvements.

Internal

Documentation and metadata improvements.

Is Malware Family

Documentation and metadata improvements.

Is Processed

Documentation and metadata improvements.

Issuer

Documentation and metadata improvements.

Issuer DN

Documentation and metadata improvements.

Job Code

Documentation and metadata improvements.

Job Family

Documentation and metadata improvements.

Job Function

Documentation and metadata improvements.

Key Value

Documentation and metadata improvements.

Kill Chain Phases

Documentation and metadata improvements.

Languages

Documentation and metadata improvements.

Last Seen By Source

Documentation and metadata improvements.

Leadership

Documentation and metadata improvements.

Location

Documentation and metadata improvements.

Location Region

Documentation and metadata improvements.

MD5

Documentation and metadata improvements.

Malware Family

Documentation and metadata improvements.

Malware types

Documentation and metadata improvements.

Manager Email Address

Documentation and metadata improvements.

Manager Name

Documentation and metadata improvements.

Memory

Documentation and metadata improvements.

Mitre ID

Documentation and metadata improvements.

Mitre Tactics

Documentation and metadata improvements.

Mobile Phone

Documentation and metadata improvements.

Name

Documentation and metadata improvements.

Name Field

Documentation and metadata improvements.

Name Servers

Documentation and metadata improvements.

Number of subkeys

Documentation and metadata improvements.

OS Version

Documentation and metadata improvements.

Objective

Documentation and metadata improvements.

Office365Category

Documentation and metadata improvements.

Office365ExpressRoute

Documentation and metadata improvements.

Office365Required

Documentation and metadata improvements.

Operating System

Documentation and metadata improvements.

Operating System Refs

Documentation and metadata improvements.

Operating System Version

Documentation and metadata improvements.

Org Level 1

Documentation and metadata improvements.

Org Level 2

Documentation and metadata improvements.

Org Level 3

Documentation and metadata improvements.

Org Unit

Documentation and metadata improvements.

Organization

Documentation and metadata improvements.

Organization First Seen

Documentation and metadata improvements.

Organization Last Seen

Documentation and metadata improvements.

Organization Prevalence

Documentation and metadata improvements.

Organization Type

Documentation and metadata improvements.

Organizational Unit (OU)

Documentation and metadata improvements.

PEM

Documentation and metadata improvements.

Path

Documentation and metadata improvements.

Paths

Documentation and metadata improvements.

Personal Email

Documentation and metadata improvements.

Port

Documentation and metadata improvements.

Positive Detections

Documentation and metadata improvements.

Primary Motivation

Documentation and metadata improvements.

Processor

Documentation and metadata improvements.

Processors

Documentation and metadata improvements.

Product

Documentation and metadata improvements.

Public Key

Documentation and metadata improvements.

Publications

Documentation and metadata improvements.

Published

Documentation and metadata improvements.

Quarantined

Documentation and metadata improvements.

Query Language

Documentation and metadata improvements.

Rank

Documentation and metadata improvements.

Region

Documentation and metadata improvements.

Registrant Country

Documentation and metadata improvements.

Registrant Email

Documentation and metadata improvements.

Registrant Name

Documentation and metadata improvements.

Registrant Phone

Documentation and metadata improvements.

Registrar Abuse Address

Documentation and metadata improvements.

Registrar Abuse Country

Documentation and metadata improvements.

Registrar Abuse Email

Documentation and metadata improvements.

Registrar Abuse Name

Documentation and metadata improvements.

Registrar Abuse Network

Documentation and metadata improvements.

Registrar Abuse Phone

Documentation and metadata improvements.

Registrar Name

Documentation and metadata improvements.

Report Object References

Documentation and metadata improvements.

Report type

Documentation and metadata improvements.

Reported By

Documentation and metadata improvements.

Reports

Documentation and metadata improvements.

Resource Level

Documentation and metadata improvements.

Roles

Documentation and metadata improvements.

SHA1

Documentation and metadata improvements.

SHA256

Documentation and metadata improvements.

SHA512

Documentation and metadata improvements.

SPKI SHA256

Documentation and metadata improvements.

SSDeep

Documentation and metadata improvements.

STIX Aliases

Documentation and metadata improvements.

STIX Description

Documentation and metadata improvements.

STIX Goals

Documentation and metadata improvements.

STIX ID

Documentation and metadata improvements.

STIX Is Malware Family

Documentation and metadata improvements.

STIX Kill Chain Phases

Documentation and metadata improvements.

STIX Malware Types

Documentation and metadata improvements.

STIX Primary Motivation.

Documentation and metadata improvements.

STIX Resource Level

Documentation and metadata improvements.

STIX Roles

Documentation and metadata improvements.

STIX Secondary Motivations

Documentation and metadata improvements.

STIX Sophistication

Documentation and metadata improvements.

STIX Threat Actor Types

Documentation and metadata improvements.

STIX Tool Types

Documentation and metadata improvements.

STIX Tool Version

Documentation and metadata improvements.

SWID

Documentation and metadata improvements.

Samples

Documentation and metadata improvements.

Secondary Motivations

Documentation and metadata improvements.

Serial Number

Documentation and metadata improvements.

Service

Documentation and metadata improvements.

Short Description

Documentation and metadata improvements.

Signature Algorithm

Documentation and metadata improvements.

Signature Authentihash

Documentation and metadata improvements.

Signature Copyright

Documentation and metadata improvements.

Signature Description

Documentation and metadata improvements.

Signature File Version

Documentation and metadata improvements.

Signature Internal Name

Documentation and metadata improvements.

Signature Original Name

Documentation and metadata improvements.

Signed

Documentation and metadata improvements.

Size

Documentation and metadata improvements.

Sophistication

Documentation and metadata improvements.

Source Original Severity

Documentation and metadata improvements.

Source Priority

Documentation and metadata improvements.

State

Documentation and metadata improvements.

Street Address

Documentation and metadata improvements.

Subdomains

Documentation and metadata improvements.

Subject

Documentation and metadata improvements.

Subject Alternative Names

Documentation and metadata improvements.

Subject DN

Documentation and metadata improvements.

Surname

Documentation and metadata improvements.

Targets

Documentation and metadata improvements.

Threat Actor Types

Documentation and metadata improvements.

Threat Types

Documentation and metadata improvements.

Title

Documentation and metadata improvements.

Tool Types

Documentation and metadata improvements.

Tool Version

Documentation and metadata improvements.

Traffic Light Protocol

Documentation and metadata improvements.

Updated Date

Documentation and metadata improvements.

User ID

Documentation and metadata improvements.

Username

Documentation and metadata improvements.

Validity Not After

Documentation and metadata improvements.

Validity Not Before

Documentation and metadata improvements.

Vendor

Documentation and metadata improvements.

Version

Documentation and metadata improvements.

Vulnerabilities

Documentation and metadata improvements.

Vulnerable Products

Documentation and metadata improvements.

Whois Records

Documentation and metadata improvements.

Work Phone

Documentation and metadata improvements.

X.509 v3 Extensions

Documentation and metadata improvements.

Zip Code

Documentation and metadata improvements.

imphash

Documentation and metadata improvements.

Indicator Types

ASN
Documentation and metadata improvements.
Account
Documentation and metadata improvements.
Attack Pattern
Documentation and metadata improvements.
CIDR
Documentation and metadata improvements.
CVE
Documentation and metadata improvements.
Campaign
Documentation and metadata improvements.
Course of Action
Documentation and metadata improvements.
DomainGlob
Documentation and metadata improvements.
Email
Documentation and metadata improvements.
File MD5
Documentation and metadata improvements.
File SHA-1
Documentation and metadata improvements.
File SHA-256
Documentation and metadata improvements.
Host
Documentation and metadata improvements.
IPv6CIDR
Documentation and metadata improvements.
Identity
Documentation and metadata improvements.
Infrastructure
Documentation and metadata improvements.
Intrusion Set
Documentation and metadata improvements.
Location
Documentation and metadata improvements.
Malware
Documentation and metadata improvements.
Mutex
Documentation and metadata improvements.
Onion Address
Documentation and metadata improvements.
Registry Key
Documentation and metadata improvements.
Report
Documentation and metadata improvements.
Software
Documentation and metadata improvements.
Tactic
Documentation and metadata improvements.
Threat Actor
Documentation and metadata improvements.
Tool
Documentation and metadata improvements.
X509 Certificate
Documentation and metadata improvements.
ssdeep
Documentation and metadata improvements.
Domain
Added support for the xti module.
File
Added support for the xti module.
IP
Added support for the xti module.
IPv6
Added support for the xti module.
URL
Added support for the xti module.

Layout Rules

Indicator Feed Layout Rule

Documentation and metadata improvements.

Vulnerability Layout Rule

Documentation and metadata improvements.

Layouts

ASN
Documentation and metadata improvements.
Account Indicator
Documentation and metadata improvements.
Attack Pattern
Documentation and metadata improvements.
CVE Indicator
Documentation and metadata improvements.
Campaign
Documentation and metadata improvements.
Course of Action
Documentation and metadata improvements.
Domain Indicator
Documentation and metadata improvements.
Email Indicator
Documentation and metadata improvements.
File Indicator
Documentation and metadata improvements.
Host Indicator
Documentation and metadata improvements.
IP Indicator
Documentation and metadata improvements.
Identity
Documentation and metadata improvements.
Indicator Feed Incident
Documentation and metadata improvements.
Infrastructure
Documentation and metadata improvements.
Intrusion Set
Documentation and metadata improvements.
Location
Documentation and metadata improvements.
Malware Indicator
Documentation and metadata improvements.
Mutex
Documentation and metadata improvements.
Registry Key Indicator
Documentation and metadata improvements.
Report
Documentation and metadata improvements.
Software
Documentation and metadata improvements.
Tactic Layout
Documentation and metadata improvements.
Threat Actor
Documentation and metadata improvements.
Tool Indicator
Documentation and metadata improvements.
URL Indicator
Documentation and metadata improvements.
Vulnerability Incident
Documentation and metadata improvements.
X509 Certificate
Documentation and metadata improvements.

Mappers

Mail Listener - Incoming Mapper

Documentation and metadata improvements.

Related pull requests:
- 45355

Download

3.10.13 - 10750492 (July 5, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44960

Download

3.10.12 - 10424072 (June 24, 2026)

Layout Rules

Indicator Feed Layout Rule

Documentation and metadata improvements.

Vulnerability Layout Rule

Documentation and metadata improvements.

Related pull requests:
- 44564

Download

3.10.11 - 9233795 (May 24, 2026)

Incident Fields

Last Update Time
Added the CrowdStrike Falcon IOA Event incident type to the associated types of the Last Update Time incident field.

Related pull requests:
- 44334

Download

3.10.10 - 8801294 (May 6, 2026)

Layouts

URL Indicator
Updated Add tags and Remove tags in the URL Indicator layout to use a pipe (|) delimiter.

Related pull requests:
- 44206

Download

3.10.9 - 8727847 (May 4, 2026)

Indicator Types

IPv6
Fixed an issue where IPv6 indicators with a trailing :: (for example, aaaa:9999:1111:ffff::) were not extracted.

Related pull requests:
- 44112

Download

3.10.8 - 8382811 (April 20, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43976

Download

3.10.7 - 8288718 (April 15, 2026)

Indicator Types

Domain
Fixed an issue where false-positive domain indicators were extracted.

Related pull requests:
- 43856

Download

3.10.6 - 8227525 (April 13, 2026)

Incident Fields

Last Update Time
Updated the Last Update Time incident field to support the CrowdStrike Falcon Intelligence Recon incident type.

Related pull requests:
- 42097
- 41869

Download

3.10.5 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43567

Download

3.10.4 - 7478701 (March 8, 2026)

Incident Fields

Last Update Time
Added the GravityZone EDR, and GravityZone XDR incident types as associated types.

Related pull requests:
- 43387
- 42789

Download

3.10.3 - 7379405 (March 1, 2026)

Indicator Types

IPv6
Fixed an issue where the IPv6 indicator type regex failed to extract an IPv6 address from input text containing line breaks.

Related pull requests:
- 43284

Download

3.10.2 - 7188558 (February 17, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43146

Download

3.10.1 - 6920581 (January 28, 2026)

Incident Fields

Traffic Direction
Updated the Traffic Direction incident field to associate 'Trellix Incident' type.
Vendor Product
Updated the Vendor Product incident field to associate 'Trellix Incident' type.
UUID
Updated the UUID incident field to associate 'Trellix Incident' type.

Related pull requests:
- 42762

Download

3.10.0 - 6802612 (January 20, 2026)

Incident Fields

Vendor Product
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Last Update Time
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
UUID
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
End Time
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Display Name
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Start Time
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Risk Score
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.
Detection ID
Added the CrowdStrike Falcon NGSIEM Case, CrowdStrike Falcon NGSIEM Incident, and CrowdStrike Falcon NGSIEM Automated Lead incident types as associated types.

Related pull requests:
- 42537

Download

3.9.9 - 6640287 (January 11, 2026)

Indicator Types

URL
Updated the URL indicator regex to handle defanged IP addresses with a [.] notation (e.g., 45.134.174[.]235/2.sh).

Related pull requests:
- 42595

Download

3.9.8 - 6580350 (January 6, 2026)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 42564

Download

3.9.7 - 5888286 (November 16, 2025)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41916

Download

3.9.6 - 5538136 (October 23, 2025)

Common Types

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41627

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 26, 2020
Last Release	October 14, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

Palo Alto Networks - Prisma Cloud Compute

VMware Carbon Black Endpoint Standard (Deprecated)

Mandiant Automated Defense (Formerly Respond Software)

Palo Alto Networks Cortex XDR - Investigation and Response

Symantec Data Loss Prevention (Deprecated)

Check Point EM ThreatCloud Intelligence Feed

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.

Common Types

Pack Contributors:

Pack Contributors:

Common Types

Common Types

Classifiers

Mail Listener - Classifier

Incident Fields

Incident Types

Indicator Fields

AS Owner

ASN

Account Type

Acquisition Hire

Action

Actor

Admin Country

Admin Email

Admin Name

Admin Phone

Aliases

Applications

Architecture

Assigned role

Assigned user

Associated File Names

Associations

Author

BIOS Version

Behavior

Blocked

CPE

CVE Description

CVE Modified

CVSS

CVSS Score

CVSS Table

CVSS Vector

CVSS Version

CVSS3

Campaign

Capabilities

Category

Certificate Names

Certificate Signature

Certificate Validation Checks

Certificates

City

Commands

Community Notes

Confidence

Cost Center

Cost Center Code

Country Code

Country Code Number

Country Name

Creation Date

DHCP Server

DNS

DNS Records

Definition

Department

Description

Detection Engines

Detections

Device Model

Display Name

Domain IDN Name

Domain Name

Domain Referring IPs

Domain Referring Subnets

Domain Status

Domains

Download URL

Email

Email Address

Entry ID

Expiration Date

Extension

Feed Related Indicators