Additional References

Table for POST /xsoar/public/v1/indicators/feed/json

Property	Required?	Type	Notes
value	Required	string
type	Required	string
score	Optional	number	Possible values: 0-3. Default is 0, where 0 means None, 1 Good, 2 Suspicious, and 3 Bad
sourceBrand	Optional	string	Default is External
sourceInstance	Optional	string	Default is External
reliability	Optional	string	Possible values: A - Completely reliable, B - Usually reliable, C - Fairly reliable, D - Not usually reliable, E - Unreliable, F - Reliability cannot be judged
expirationPolicy	Optional	string	Possible values: never, interval, indicatorType
expirationInterval	Optional	number	Interval in minutes

Incident Fields Table

Field	Value
Incident Name	b
Occurred	2024-02-21 09:40:31.478767484 +0000 UTC
Owner	[e-mail]
Type	default_rocket_type
Severity	Unknown
Playbook
Phase
SolarWinds Event NetObject ID	0
Xpanse Service Validation	[{"columnheader1":""},{},{}]
rocket_field_9cXC2WVD	0
rocket_field_wXYX6uGG	0
rocket_field_zfML4cE0	false
Select Action	Close
rocket_field_42Q8Ri0W	Status: idle
rocket_field_AaX9wGTe	[{}]
rocket_field_CfZmni5R	Status: idle
rocket_field_qKCO0ydE	[{}]
rocket_field_tB9lEkl5	0
Campaign Email Sender Instance	rocket_gmail_instance_5p8iV9OZ
rocket_field_GKrAoBGl	0
SolarWinds Instance Site ID	0
Inventa Source	[{}]
rocket_field_ThpRM0UI	false
rocket_field_Hx9VM4pC	false
XM Cyber security score trend	0
FortiSIEM Events	[{}]
rocket_field_02MXekkB	option_f1kSTDSS
Time to Assignment	Status: idle
XDR Investigation results	[{},{},{},{"columnheader1":""},{},{"columnheader1":""},{},{}]
ServiceNow Severity	1 - High
rocket_field_iUoszZbg	Status: idle
rocket_field_O1yXp4Dy	[{}]
Remediation SLA	Status: idle
rocket_field_zGSjDuQE	rocket_lTsQkUAH
Datadog Cloud SIEM Customer Impacted	false
Dataminr Pulse Related Terms	[{},{},{}]
RDPCacheHunting Strings Similarity	[{},{},{}]
rocket_field_Uo7LGQJ9	0
Email Delete From Brand	Unspecified
rocket_field_C04gZmJA	0
rocket_field_KetHuvYK	Status: idle
rocket_field_BTdE7csG	0
rocket_field_F1zOPNIb	0
rocket_field_oOiSzo3v	false
rocket_field_XrBpJHNc	[{}]
TheHive Flag	false
Xpanse Service Classifications	[{},{},{}]
DBotPredictionProbability	0
rocket_field_jbpBUEdw	Status: idle
rocket_field_yfUtODrw	false
SolarWinds Event Engine ID	0
rocket_field_J8zKFsyM	[{}]
rocket_field_o4ZG2bvA	Status: idle
rocket_field_PUfEsh2i	Status: idle
ServiceNow Business Impact	1 - Critical
ServiceNow SIR State	New
Datadog Cloud SIEM User Is Service	false
Qintel QWatch Exposures	[{},{},{}]
rocket_field_yM2KVwjH	Status: idle
Containment SLA	Status: idle
External ID	157448
rocket_field_DPma6rXc	[{}]
rocket_field_OhQJmX5W	false
rocket_field_oq4Ib3Rq	Status: idle
rocket_field_xSD42019	0
rocket_field_6mO51xzN	rocket_2G5KQgOq
rocket_field_jj5VB0LK	0
rocket_field_FvAoEcwO	false
rocket_field_oizBgs9u	0
rocket_field_qUB0KXF8	Status: idle
rocket_field_RBxB2vfR	0
rocket_field_8WNmYYVC	rocket_30PKbAUW
rocket_field_BMhsQOpn	Status: idle
rocket_field_BZxREVRQ	Status: idle
rocket_field_OUPkDDJ1	Status: idle
rocket_field_V2iGLhEi	ATGQkF
rocket_field_xw7hSi6S	0
AWS GuardDuty Confidence Score	0
rocket_field_dIuCwG95	0
rocket_field_KUn3mu2U	false
Cohesity Helios Cluster Id	0
DeCYFIR Data Details	[{},{},{}]
rocket_field_wYw5IW48	rocket_0xYBncbK
Datadog Cloud SIEM User Verified	false
rocket_field_PHyIvfgh	rocket_vvOoi235
XDR Starred	false
ExtraHop Reveal(x) Mitre Techniques	[{},{},{}]
rocket_field_pN5NX1QC	0
Incident Duration	Status: idle
RiskIQ Auto Exclude Whitelisted IP Address	Yes
rocket_field_cfDRG1gV	0
ServiceNow Notify	Send Email
rocket_field_f0mRcM8q	[{}]
rocket_field_NLyjpP21	false
rocket_field_4r4tIz6W	false
Number of Related Incidents	0
rocket_field_gCjnl61D	0
rocket_field_JIaR3E0A	rocket_12IRzenM
rocket_field_PqKOFAv0	0
BmcITSM Customer	[{}]
rocket_field_uRfK9syH	OnushD
CrowdStrike Falcon Behaviour Pattern Disposition Details	[{},{},{}]
rocket_field_BP7q7Pbn	0
rocket_field_QyEq7XPv	rocket_Sj6ZQfYt
rocket_field_3RxB5haR	Status: idle
rocket_field_EYInCU1N	false
rocket_field_qp0o4lmH	rocket_BlnkYAhj
rocket_field_XYQyxhpn	0
ServiceNow Impact	1 - High
ServiceNow Urgency	1 - High
rocket_field_eIxka2g7	0
rocket_field_MSXZnC2Y	0
rocket_field_I3YadN4O	false
rocket_field_Xf0uuduk	0
Saas Security State	open
RSA Metas Events	[]
ExtraHop Reveal(x) Detection Devices	[{},{},{}]
rocket_field_qku2KT7J	rocket_8lraojiF
rocket_field_XTmM8iX9	Status: idle
RiskIQ Auto Whitelist IP Address	Yes
ServiceNow Priority	1 - Critical
rocket_field_XKEvyILP	0
SolarWinds Alert Object ID	0
Actions On Low Similarity Incidents	Add To Campaign
rocket_field_9XA0O3nq	WZ3sR6
rocket_field_BxVy7ACI	Status: idle
rocket_field_wAwulkZU	false
CRYPTOSIM Correlation ID	0
rocket_field_1m1nkNsl	rocket_kUrYJCYH
rocket_field_eyw5E4sM	0
CRYPTOSIM Category ID	0
rocket_field_aENrumCR	Uo3MEg
rocket_field_a40b2sfG	0
rocket_field_BTdE7csG	0
rocket_field_oq4Ib3Rq	Status: idle
Datadog Cloud SIEM Customer Impacted	false
SolarWinds Event NetObject ID	0
Chronicle Skip Entity Isolation	Yes
DBotPredictionProbability	0
Incident Duration	Status: idle
rocket_field_qKCO0ydE	[{}]
Saas Security Remediation Type	Remove public sharing
Cohesity Helios Cluster Id	0
Inventa Source	[{}]
RiskIQ Auto Whitelist IP Address	Yes
rocket_field_kpgyU158	[{}]
rocket_field_XYQyxhpn	0
rocket_field_VsEhZB8s	[{}]
Xpanse Service Classifications	[{},{},{}]
BmcITSM Customer	[{}]
rocket_field_yM2KVwjH	Status: idle
CrowdStrike Falcon Behaviour Pattern Disposition Details	[{},{},{}]
rocket_field_H5KQJHzc	0
rocket_field_OOBHWdtf	0
rocket_field_tB9lEkl5	0
rocket_field_TZphELjw	Status: idle
rocket_field_wYw5IW48	rocket_0xYBncbK
rocket_field_zGSjDuQE	rocket_lTsQkUAH
ServiceNow SIR State	New
rocket_field_f0mRcM8q	[{}]
rocket_field_JIaR3E0A	rocket_12IRzenM
Datadog Cloud SIEM Detect and Create Duration	0
rocket_field_e2kKCGrH	0
rocket_field_eyw5E4sM	0
rocket_field_MSXZnC2Y	0
XDR Alert Search Results	[{},{},{}]
rocket_field_BP7q7Pbn	0
rocket_field_Hx9VM4pC	false
rocket_field_QyEq7XPv	rocket_Sj6ZQfYt
rocket_field_aENrumCR	Uo3MEg
rocket_field_OUPkDDJ1	Status: idle
Dataminr Pulse Related Terms	[{},{},{}]
Is VPN IP Address	false
rocket_field_3RxB5haR	Status: idle
rocket_field_F1zOPNIb	0
rocket_field_Vh1YDrmm	option_PKIbNz9h
ExtraHop Reveal(x) Detection Devices	[{},{},{}]
rocket_field_CJNGZ1hr	false
File Relationships	[{},{},{}]
rocket_field_pN5NX1QC	0
rocket_field_qp0o4lmH	rocket_BlnkYAhj
rocket_field_SiqptQqU	0
XM Cyber security score trend	0
rocket_field_4r4tIz6W	false
rocket_field_VX1MzTGQ	0
SolarWinds Alert ID	0
rocket_field_4EjUBigQ	0
SolarWinds Acknowledged	false
FortiSIEM Attack Tactics	[{},{}]
rocket_field_A28fG0OJ	Status: idle
rocket_field_BtNdlwtX	0
rocket_field_EYInCU1N	false
rocket_field_FvAoEcwO	false
Qintel QWatch Exposures	[{},{},{}]
rocket_field_RhblDnmx	0
rocket_field_KetHuvYK	Status: idle
rocket_field_XTmM8iX9	Status: idle
rocket_field_dIuCwG95	0
Number of similar files	0
rocket_field_9cXC2WVD	0
rocket_field_l9viBXoN	0
RDPCacheHunting String Sifter	[{},{},{}]
rocket_field_bDvHqhgD	0
rocket_field_gCjnl61D	0
rocket_field_J8zKFsyM	[{}]
rocket_field_jj5VB0LK	0
rocket_field_PUfEsh2i	Status: idle
Containment SLA	Status: idle
Suspicious Executions	[{},{},{}]
rocket_field_xw7hSi6S	0
rocket_field_0QIeTiLT	[{}]
SolarWinds Alert Object ID	0
SolarWinds Instance Site ID	0
rocket_field_BMhsQOpn	Status: idle
rocket_field_BZxREVRQ	Status: idle
rocket_field_ptuLAVSO	false
ServiceNow Priority	1 - Critical
test_ivan	false
Campaign Email Sender Instance	rocket_gmail_instance_5p8iV9OZ
rocket_field_dPYdb2Ts	rocket_mCQCvo20
rocket_field_o4ZG2bvA	Status: idle
SolarWinds Alert Related Node ID	0
DomainToolsIrisDetect	[{},{},{}]
rocket_field_42Q8Ri0W	Status: idle
rocket_field_qUB0KXF8	Status: idle
rocket_field_Uo7LGQJ9	0
Datadog Cloud SIEM User Verified	false
rocket_field_82dossWp	0
rocket_field_lYEffLPK	Status: idle
SolarWinds Active Alert ID	0
Datadog Cloud SIEM Repair Time	0
rocket_field_1m1nkNsl	rocket_kUrYJCYH
rocket_field_7PRuMt0z	Status: idle
ServiceNow SIR Category	Confidential personal identity data exposure
Microsoft Sentinel Owner	[]
rocket_field_DiwD4Pdj	0
rocket_field_mc5SBBxx	0
rocket_field_mnUeZx1q	rocket_bU5TjVJf
rocket_field_nqJoEhXl	[{}]
ServiceNow Impact	1 - High
rocket_field_2f1RAM7U	false
rocket_field_AaX9wGTe	[{}]
rocket_field_C04gZmJA	0
Failed Logon Events	0
rocket_field_oizBgs9u	0
rocket_field_wXYX6uGG	0
Select Action	Close
SpyCloud Compass Device-Data	[{},{},{}]
Endpoint	[{}]
rocket_field_D9Wodnig	false
rocket_field_RQsKWjv8	[{}]
Detection SLA	Status: idle
rocket_field_ThTTy9NN	false
ServiceNow Notify	Send Email
rocket_field_I3YadN4O	false

Label Type Table

Label Type	Value
Instance	[e-mail]
Brand	Manual

Field Changes Table

Incident was modified.

Field changes

Field	Old Value	New Value
Closing Notes		close_note_oAZROKPJ