Each Incident Type should show the information
that is most relevant to it. That includes the right fields and
information types in the right places.
Select the incident type whose layout you want to edit
You are presented with the current layout, which
is populated with demo data so you can see how the fields fit.
Drag and drop the tabs to reorder
their appearance. For example, drag the War Room so it appears after
the Work Plan. You can also click
add a tab that currently does not exist.
Manage general settings for a tab.
You can configure which tabs appear and for whom, as well
as duplicate or remove tabs from the layout.
Hover over the tab that you want to configure.
Click the gear icon.
You are presented with the following options:
Define the section properties.
You can determine how a section in the layout appears in
the layout. For example, does the section include the section header
or not. You can also configure the fields to appear in rows or as
cards. For example, if you know that some of the field values will
be very long, you are better off using rows. If you know that the
field values are short, you might want to use cards so you can fit
more fields in a section.
To remove or duplicate a section, or change
Click the section title. In the image above, that
is Timeline Information.
Click the pencil icon and select the relevant option.
To change the information that appears in dynamic sections:
Click the section title. For example, Indicators.
Click the pencil icon and select
Edit section settings
, enter the parameters
by which you want to filter the information that appears.
example, to see all indicators of type IP and with a reputation
of Bad that were found by a specific feed since March 1st 2020,
enter Type:IP and reputation:Bad and firstseenbyfeed:>="2020-03-01T00:00:00 +0200".
Add New sections or fields to a Layout
You can add new sections or fields to the layout by dragging
and dropping them from the Library on the left into the layout.
- Add a Button Field
Under the Fields section of the Layout Builder Library,
field into the relevant section.
Click to configure
Enter a descriptive name for the button and select
the script that you want to run when the button is clicked.