A case template is defined as below.
{
"name": "ransomware_infection",
"display_name": "Ransomware Infection Template",
"description": "This case template describes first-response tasks to handle information system compromised by a ransomware.",
"author": "DFIR-IRIS",
"title_prefix": "RANS",
"summary": "# Context \n\n\n # Contact \n\n\n # Actions \n\n\n",
"tags": ["ransomware","malware"],
"tasks": [
{
"title": "Identify the perimeter",
"description": "The perimeter of compromise must be identified",
"tags": ["identify"]
},
{
"title": "Collect compromised hosts",
"description": "Deploy Velociraptor and start collecting evidence",
"tags": ["collect", "velociraptor"]
},
{
"title": "Contain"
}
],
"note_groups": [
{
"title": "Identify",
"notes": [
{
"title": "Identify the compromised accounts",
"content": "# Observations\n\n"
}
]
},
{
"title": "Collect",
"notes": [
{
"title": "Velociraptor deployment"
},
{
"title": "Assets collected",
"content": "# Assets collected\n\n# Assets not collected"
}
]
}
]
}
Field types
The supported fields types are:
- name: The name of the case template (required).
- display_name: The displayed name of the case template.
- description: The description of the case template.
- author: The author of the case template (not related to the current user).
- title_prefix: A prefix to add to case title.
- summary: content to prefill the summary.
- tags: A list of case tags.
- tasks: A list of dictionaries defining tasks. Tasks are defined by title (required), description, and list of tags.
- note_groups: A list of dictionaries defining note groups. Note groups are defined by title (required), and list of notes. Notes have title (required) and content