Customize Indicator View Layouts - Administrator Guide - 6.6 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.6
Creation date
2022-09-29
Last date published
2024-03-21
End_of_Life
EoL
Category
Administrator Guide
Abstract

Overview of the indicator view layout in Cortex XSOAR.

Note

The indicator Full View is not available for new customers who have not purchased a TIM license.

Each indicator type has a unique set of data relevant to that specific indicator type. It is important to display the most relevant data for users.

For each indicator type, there are two views:

  • Indicator Summary

  • Quick View

You can customize how the information is displayed for existing indicators by modifying the sections and fields for each view.

You can access the Indicator quick view when you click an indicator on an incident page or on the canvas.

Inline Value Fields

By default, when editing the following inline values in a indicator, the changes are not saved until you confirm your changes (clicking the checkmark icon in the value field).

  • Dropdown values

  • Text values

These icons are designed to let you have an additional level of security before you make changes to the fields in threat indicators, incidents, and intel reports.

To change the default behavior set the inline.edit.on.blur server configuration to true, which enables you to make changes to inline fields without clicking the checkmark. The changes are automatically saved when clicking anywhere on the page or when navigating to another page. For text values you can also click anywhere in the value field to edit.