End-of-Life (EoL)

Add a Custom Widget to the Incident page

types layoutBuilder Follow these instructions to add a custom widget when viewing an incident.
You can add a custom widget in the
Incident info
tab to incident types when you view a detailed incident. Every time you open the incident you can see the widget.
The following example, shows how to add the Indicator Widget Bar to all
Phishing
incident types in the
Incident info
tab. This custom widget script that shows the severity of indicators in an incident, as a bar chart.
  1. Create the Indicator Widget Bar automation.
    1. In the
      Automation
      page, add the following script:
      commonfields: id: ee3b9604-324b-4ab5-8164-15ddf6e428ab version: 49 name: IndicatorWidgetBar script: |- # Constants HIGH = 3 SUSPICIOUS = 2 LOW = 1 NONE = 0 indicators = [] scores = {HIGH: 0, SUSPICIOUS: 0, LOW: 0, NONE: 0} incident_id = demisto.incidents()[0].get('id') foundIndicators = demisto.executeCommand("findIndicators", {"query":'investigationIDs:{}'.format(incident_id), 'size':999999})[0]['Contents'] for indicator in foundIndicators: scores[indicator['score']] += 1 data = { "Type": 17, "ContentsFormat": "bar", "Contents": { "stats": [ { "data": [ scores[HIGH] ], "groups": None, "name": "high", "label": "incident.severity.high", "color": "rgb(255, 23, 68)" }, { "data": [ scores[SUSPICIOUS] ], "groups": None, "name": "medium", "label": "incident.severity.medium", "color": "rgb(255, 144, 0)" }, { "data": [ scores[LOW] ], "groups": None, "name": "low", "label": "incident.severity.low", "color": "rgb(0, 205, 51)" }, { "data": [ scores[NONE] ], "groups": None, "name": "unknown", "label": "incident.severity.unknown", "color": "rgb(197, 197, 197)" } ], "params": { "layout": "horizontal" } } } demisto.results(data) type: python tags: - dynamic-section enabled: true scripttarget: 0 subtype: python3 runonce: false dockerimage: demisto/python3:3.7.3.286 runas: DBotWeakRole
    2. Click Save.
  2. Copy the Phishing incident layout.
    1. Select
      Settings
      Advanced
      Layouts
      Phishing Incident
    2. Click
      Duplicate
      .
      A copy of the Phishing indicator type appears, called
      Phishing Incident_copy
      .
    3. Click
      Phishing Incident_copy
      .
    4. Drag and drop the
      General Purpose Dynamic Section
      into the layout area.
    5. Edit the
      General Purpose Dynamic Section
      by adding the name, and the script created in step 1.
    6. Click Save.
  3. Add the
    Phishing Incident_copy
    layout to the Phishing incident type.
    1. Select
      Incident Types
      Phishing
      Edit
      .
    2. From the
      Edit Incident Type
      dialog box, in the
      Layout
      field, from the drop down list, add
      Phishing Incident_copy
      .
    3. Click
      Save
      .
  4. View the Indicator Widget Bar in a phishing incident.
    1. Go to the
      Incidents
      page.
    2. Select an incident with incident type
      Phishing
      .
      In the Click the
      Incident Info
      tab you can see the Incident Widget Bar:

Recommended For You