Work with Incidents
Configure tabs and scripts for the Cortex XSOAR Enterprise
mobile app. View incident summary, war room chat, complete tasks,
add tabs.
View all the incidents according to your
selected filter.
In the Cortex XSOAR Web app, when customizing incident
layouts, you can decide which tabs appear in the mobile app,
by selecting the
Show this tab on Cortex XSOAR mobile
app if role allows
checkbox. Only mobile supported tabs
have this checkbox (for example, Work Plan and the Evidence tabs
do not have the checkbox and will not appear in the mobile app).
By default, all mobile supported tabs have the checkbox selected.
When you add new tabs, you can also select whether they can be viewed
in the mobile app.If you want to run commands in the mobile app such as escalation
or enrichment, you need to add a script button to the tab, when customizing incident
layouts in the Web. It is useful to add a button when you
are undertaking war room commands or other custom actions in the
mobile app. When clicking the button you created, a message appears
showing whether it was successful in the mobile app. The results
can be viewed in the War Room (web only).
You can view the following tabs:
- SummaryThe incident summary supports a limited number of sections and fields. If you want to create a custom incident summary layout for the mobile app you need to customizing incident layouts in the Web.
- War Room ChatYou can view, send and receive messages, upload, download files, and attachments.
- TasksYou can assign analysts to the task, chose options to complete the task and manually mark the task as complete.
To perform action on the incident, tap
. Support.
Supported incident actions include:- Assign an analyst to the incident
- Change the incident severity
- Change the incident type
- Close the incident
