Customize Incident Layouts

(
System Incident Type
) Create a copy of the incident layout.
Go to
Settings
Advanced
Layouts
.
Select the check box for the incident layout you want to edit.
Click
Duplicate
.
A copy of the incident layout appears with the string _copy appended to the name of the incident layout. If more than one copy of the incident layout is created, a number is appended to the _copy string. The number is increased with each additional duplication.
Click the name of the newly created incident layout.
You are presented with the current layout, which is populated with demo data so you can see how the fields fit.
(
Custom Incident Type
) Edit the incident type layout.
Go to
Settings
Advanced
Incident Types
.
Select the incident type whose layout you want to edit and click the
Edit Layout
.
You are presented with the current layout, which is populated with demo data so you can see how the fields fit.
Ensure you select an incident type where the
Layout
field is empty.
In the
Incident Summary
tab, customize the tabs.
Click and drag the tab to reorder the appearance of the tabs. For example, you can move the War Room tab so it appears after the Work Plan tab.
Configure which tabs appear and for whom, as well as duplicate or remove tabs from the layout, by hovering over the tab that you want to configure.
Click the gear icon.
Click one of the following options:
Rename
Duplicate
Delete
Hide
Viewing Permissions: From the drop down list, add the roles who can view the tabs. Default is to allow all roles.
Not all of the options are available for each tab.
Add sections to the layout.
From the Library section, in the Cortex XSOAR Sections drag and drop the required sections as follows:

Section	Description
New Section	After creating a new section, click the <Incident Type> Fields tab and drag and drop the fields as required.
Cortex XSOAR out of the box sections	Out of the box sections such as Attachments, Evidence, and so on.
General Purpose Dynamic Section	Enables you to assign a script to this section. For example, assign a script that calculates the total number of entries that exist for an incident, and it dynamically updates when new entries are added to the incident.
Define section properties.
You can determine how a section in the layout appears in the layout. For example, does the section include the section header or not. You can also configure the fields to appear in rows or as cards. For example, if you know that some of the field values will be very long, you are better off using rows. If you know that the field values are short, you might want to use cards so you can fit more fields in a section.
Select the section, click and then click
Edit section settings
.
Edit the section as required and click
OK
.
Click the save button or
Save Version
.
Remove or duplicate a section, by selecting the section, clicking and selecting the relevant option.
Change the information that appears in dynamic sections (for example Bad or Suspicious Indicators).
Select the section, click and select
Edit section settings
.
Under Query, enter the parameters by which you want to filter the information that appears.
For example, to see all indicators of type IP and with a reputation of Bad that were found by a specific source since March 1st 2020, enter
Type:IP and reputation:Bad and firstseenbyfeed:>="2020-03-01T00:00:00 +0200"

Click
OK
.
Add fields and custom buttons.
To add custom buttons, you need to create an automation and then add the buttons to the layout using the automation. These buttons can simplify and assist an analyst in carrying out various tasks. For example, add buttons for an analyst to self-assign an incident, link or unlink an incident, close an incident as a duplicate, generate a summary report, etc.
In the following example, we will add a button to self assign an incident for an analyst. The automation is included in the
Case Management - Generic
Content Pack.
Drag the

+New Button

and drop into the relevant section.

Click to configure

.

Enter a descriptive name for the button, select a color, and select the script that you want to run when the button is clicked.



Click

Save

.

In the

Incident Summary

tab, when clicking on

Assign To Me

, the incident will be self-assigned.


Add required sections and fields in the
New/Edit Form
,
Close Form
, and
Incident Quick View
tabs.
(
System Incident Type
) Add the layout to the incident.
Go to

Incident Types

.

Select the incident type and click

Edit

.

In the

Layout

field, from the drop down list, add the customized layout.


(
Optional
) For a customized system layout, you can contribute it to the Marketplace.
In the
Layouts
page, click the new incident type you want to contribute to Marketplace.
Complete the information in the Contribute form and click
Contribute
.