End-of-Life (EoL)

Customize an Incident Type Layout

Action Buttons Incident Types
Each Incident Type should show the information that is most relevant to it. That includes the right fields and information types in the right places.
  1. Navigate to
    Incident Types
  2. Select the incident type whose layout you want to edit and click
    Edit Layout
    You are presented with the current layout, which is populated with demo data so you can see how the fields fit.
  3. (Optional)
    Drag and drop the tabs to reorder their appearance. For example, drag the War Room so it appears after the Work Plan. You can also click
    +New tab
    to add a tab that currently does not exist.
  4. Manage general settings for a tab.
    You can configure which tabs appear and for whom, as well as duplicate or remove tabs from the layout.
    1. Hover over the tab that you want to configure.
    2. Click the gear icon.
      You are presented with the following options:
      • Rename
      • Duplicate
      • Delete
      • Hide
      • Viewing Permissions
  5. Define the section properties.
    You can determine how a section in the layout appears in the layout. For example, does the section include the section header or not. You can also configure the fields to appear in rows or as cards. For example, if you know that some of the field values will be very long, you are better off using rows. If you know that the field values are short, you might want to use cards so you can fit more fields in a section.
    1. To remove or duplicate a section, or change its properties:
      • Click the section title. In the image above, that is Timeline Information.
      • Click the pencil icon and select the relevant option.
    2. To change the information that appears in dynamic sections:
      • Click the section title. For example, Indicators.
      • Click the pencil icon and select
        Edit section settings
      • Under
        , enter the parameters by which you want to filter the information that appears.
        For example, to see all indicators of type IP and with a reputation of Bad that were found by a specific feed since March 1st 2020, enter Type:IP and reputation:Bad and firstseenbyfeed:>="2020-03-01T00:00:00 +0200".
      • Click
  6. Add New sections or fields to a Layout
    You can add new sections or fields to the layout by dragging and dropping them from the Library on the left into the layout.
    Example - Add a Button Field
    1. Under the Fields section of the Layout Builder Library, drag the
      +New Button
      field into the relevant section.
    2. Click the
      Click to configure
    3. Enter a descriptive name for the button and select the script that you want to run when the button is clicked.
    4. Click

Recommended For You