Add a Custom Widget to the Incident page

Create the Indicator Widget Bar automation.

In the
Automation
page, add the following script:
commonfields:
  id: ee3b9604-324b-4ab5-8164-15ddf6e428ab
  version: 49
name: IndicatorWidgetBar
script: |-
  # Constants
  HIGH = 3
  SUSPICIOUS = 2
  LOW = 1
  NONE = 0

  indicators = []
  scores = {HIGH: 0, SUSPICIOUS: 0, LOW: 0, NONE: 0}
  incident_id = demisto.incidents()[0].get('id')

  foundIndicators = demisto.executeCommand("findIndicators", {"query":'investigationIDs:{}'.format(incident_id), 'size':999999})[0]['Contents']

  for indicator in foundIndicators:
      scores[indicator['score']] += 1

  data = {
    "Type": 17,
    "ContentsFormat": "bar",
    "Contents": {
      "stats": [
        {
          "data": [
            scores[HIGH]
          ],
          "groups": None,
          "name": "high",
          "label": "incident.severity.high",
          "color": "rgb(255, 23, 68)"
        },
        {
          "data": [
            scores[SUSPICIOUS]
          ],
          "groups": None,
          "name": "medium",
          "label": "incident.severity.medium",
          "color": "rgb(255, 144, 0)"
        },
        {
          "data": [
            scores[LOW]
          ],
          "groups": None,
          "name": "low",
          "label": "incident.severity.low",
          "color": "rgb(0, 205, 51)"
        },
        {
          "data": [
            scores[NONE]
          ],
          "groups": None,
          "name": "unknown",
          "label": "incident.severity.unknown",
          "color": "rgb(197, 197, 197)"
        }
      ],
      "params": {
          "layout": "horizontal"
      }
    }
  }

  demisto.results(data)
type: python
tags:
- dynamic-section
enabled: true
scripttarget: 0
subtype: python3
runonce: false
dockerimage: demisto/python3:3.7.3.286
runas: DBotWeakRole
								
Click Save.

Copy the Phishing incident layout.

Select
Settings
Advanced
Layouts
Phishing Incident
Click
Duplicate
.
A copy of the Phishing indicator type appears, called
Phishing Incident_copy
.
Click
Phishing Incident_copy
.

Drag and drop the
General Purpose Dynamic Section
into the layout area.
Edit the
General Purpose Dynamic Section
by adding the name, and the script created in step 1.

Click Save.

Add the

Phishing Incident_copy

layout to the Phishing incident type.

Select
Incident Types
Phishing
Edit
.
From the
Edit Incident Type
dialog box, in the
Layout
field, from the drop down list, add
Phishing Incident_copy
.

Click
Save
.

View the Indicator Widget Bar in a phishing incident.

Go to the

Incidents

page.

Select an incident with incident type

Phishing

.

In the Click the

Incident Info

tab you can see the Incident Widget Bar: