Edit Dbot Incident and Indicator Suggestions

troubleshooting Follow these instructions to edit Dbot incident and indicator suggestions in the Canvas.

In the Investigation Canvas, Dbot provides suggestions in the Entity Library section and the

Quick View

window. You can change these suggestions by adding keys and values when adding a server configuration.

Select

Settings

About

Troubleshooting

Add Server Configuration

Add the following keys and values as required:

Key	Description
canvas.suggestions.IncidentIndicatorSuggestions.max	Maximum number of suggestions for malicious suggestions. Default: 5 Relevant for Library and Quick View.
canvas.suggestions.IncidentMutualIndicatorSuggestions.max	Maximum number of suggestions for common indicators between incidents. Default: 5 Relevant for Library and Quick View.
canvas.suggestions.IndicatorIndicatorSuggestions.max	Maximum number of suggestions for indicators. Default: 5 Relevant for Quick View.
ml.suggestions.canvas.leftpane.incidents.limit	Maximum number of incidents in the Quick View window. Default: 10 Relevant for Quick View.

Document:Cortex XSOAR Administrator’s Guide