Customize Incident Layouts
Customize incident layouts in Cortex XSOAR to view relevant information. incidents incident buttons
It is important to build or customize the layout to ensure that you see the information that is relevant to the incident type. For example, in a phishing incident you want to see email headers, which would not be relevant for an access incident.
While some information might be relevant for multiple incident types, its location in one incident type might require more prominence than in another incident type.
Both system and custom incidents appear in the
Incident Typespage. The incident layout name appears in the
To customize the layout of a system incident, you can do the following:
- Duplicate and edit an incident layout, detach the incident type and then edit the incident type to add the new layout.
- Detach the layout and edit it.
- Create a new layout, detach the incident type, and then edit the incident type to add the new layout.
You can customize the following display information for existing incidents, and the fields in incident forms, by modifying the sections and fields for each view:
- Incident Summary: Within the incident summary, you can see different tabs that appear for the incident type, some of which can be customized.You can customize almost every aspect of the layout, including which tabs appear, the order they appear, who has permissions and which information appears.You can add dynamic fields to a layout, such as a graph of the number of bad indicators, their source, and severity. Also, you can use queries to filter the information in the dynamic section to suit your exact needs.For the Mobile app, you can select which tabs to appear.
- New/Edit Form: When creating or editing an incident you can add/delete sections, and fields as required.
- Close Form: Add/delete sections and fields when closing an incident.
- Incident Quick View: Add/delete sections and fields in the Incident Quick view section in the incident.
There are several Cortex XSOAR system layout sections and fields that you cannot remove, but you can rearrange them in the layout and modify their queries and filters.
- Go to.SettingsAdvancedLayouts
- (System Incident Type) Detach the incident layout.
- Select the check box for the incident layout you want to detach.
- ClickDetach.When the layout is detached, you can also edit the layout in theIncident Typetab.
- Edit the incident type layout.
- Select the incident type whose layout you want to edit and click the layout.You are presented with the current layout, which is populated with sample data so you can see how the fields fit.
- In theIncident Summarytab, customize the tabs.
- Click and drag the tab to reorder the appearance of the tabs. For example, you can move the War Room tab so it appears after the Work Plan tab.
- Configure which tabs appear and for whom, as well as duplicate or remove tabs from the layout, by hovering over the tab that you want to configure.
- Click the cog wheel icon.
- Click one of the following options:
Not all of the options are available for each tab.
- Viewing PermissionsWhen clicking Viewing permissions, select which roles can view the tabs.You can also decide whether you want each tab to appear in the Mobile App, by selecting theShow this tab on Cortex XSOAR mobile App if role allowscheckbox. Only mobile supported tabs have this checkbox (for example,Work Planand theEvidencetabs do not have the checkbox and will not appear in the mobile app). By default, all mobile supported tabs have the checkbox selected.
- Add sections to the layout.
- From the Library section, in the Cortex XSOAR Sections drag and drop the required sections as follows:SectionDescriptionNew SectionAfter creating a new section, click thetab and drag and drop the fields as required.<Incident Type>FieldsCortex XSOAR out of the box sectionsOut of the box sections such as Attachments, Evidence, and so on.General Purpose Dynamic SectionEnables you to assign a script to this section. For example, assign a script that calculates the total number of entries that exist for an incident, and it dynamically updates when new entries are added to the incident.
- Define section properties.You can determine how a section in the layout appears in the layout. For example, does the section include the section header or not. You can also configure the fields to appear in rows or as cards. For example, if you know that some of the field values will be very long, you are better off using rows. If you know that the field values are short, you might want to use cards so you can fit more fields in a section.
- Select the section, click and then clickEdit section settings.
- Edit the section as required and clickOK.
- Click the save button orSave Version.
- Remove or duplicate a section, by selecting the section, clicking and selecting the relevant option.
- Change the information that appears in dynamic sections (for example Bad or Suspicious Indicators):
- Select the section, click and selectEdit section settings.
- Under Query, enter the parameters by which you want to filter the information that appears.For example, to see all indicators of type IP and with a reputation of Bad that were found by a specific source since March 1st 2020, enterType:IP and reputation:Bad and firstseenbyfeed:>="2020-03-01T00:00:00 +0200"
- Add fields and custom buttons.To add custom buttons, you need to create an automation and then add the buttons to the layout using the automation. These buttons can simplify and assist an analyst in carrying out various tasks. For example, add buttons for an analyst to self-assign an incident, link or unlink an incident, close an incident as a duplicate, generate a summary report, etc.The script that runs when an action button is clicked accepts only mandatory arguments through the pop up window and does not provide an option for any non-mandatory arguments to be filled in when the button is clicked. It is recommended to use a wrapper script to collect and validate arguments in scenarios where there can be a combination of mandatory and non-mandatory arguments for a button.In the following example, we will add a button to self assign an incident for an analyst. The automation is included in theCase Management - GenericContent Pack.
- Drag the+New Buttonand drop into the relevant section.
- Click to configure.
- Enter a descriptive name for the button, select a color, and select the script that you want to run when the button is clicked.
- ClickSave.In theIncident Summarytab, when clicking onAssign To Me, the incident will be self-assigned.
- Add required sections and fields in theNew/Edit Form,Close Form, andIncident Quick Viewtabs.
- (System Incident Type) If you have created a copy of the layout, add the layout to the incident.
- Go toIncident Types.
- Select the incident type and clickEdit.
- In theLayoutfield, from the drop down list, add the customized layout.
- (Optional) For a customized system layout, you can contribute it to the Marketplace.
- In theLayoutspage, click the new incident type you want to contribute to Marketplace.
- Complete the information in the Contribute form and clickContribute.
Recommended For You
Recommended videos not found.