End-of-Life (EoL)

Customize Incident View Layouts

Follow these instructions to customize Incident layouts for each incident type.
Each incident type has a unique set of data relevant to that specific incident type. It is important to display the most relevant data for users at all stages of the incident life cycle.
You can customize the display information for existing incidents, and the fields in incident forms, by modifying the sections and fields for each view.
There are several Cortex XSOAR system layout sections and fields that you cannot remove, but you can rearrange them in the layout and modify their queries and filters.
  1. Go to
    Incident Types
  2. Select the incident type check box that you want to customize.
  3. Click
    Edit Layout
  4. Select one or more of the following views to edit:
    Incident Summary
    The fields and sections displayed in the
    “New”/”Edit Form
    The fields and sections displayed when creating a new incident or editing an existing incident.
    “Close” Form
    The fields and sections when closing an incident.
    Incident Quick View
    The fields and sections when displaying the incident quick view.
    The fields or sections displayed on a mobile.
  5. From the
    section, in the
    Cortex XSOAR Sections
    drag and drop the following sections as required.
    New Section
    After creating a new section, click the
    Access Fields
    tab and drag and drop the fields as required.
    Cortex XSOAR out of the box sections
    Out of the box sections such as Attachments, Evidence, and so on.
    General Purpose Dynamic Section
    Enables you to assign a script to this section. For example, assign a script that calculates the total number of entries that exist for an incident, and it dynamically updates when new entries are added to the incident.
  6. (
    ) To edit the section, select the section, click and then
    Edit section settings
  7. Edit the section as required and click
  8. Click the save button or
    Save Version

Recommended For You