Customize an Indicator Type Layout

Go to
Settings
ADVANCED
Layouts
.
(
System Indicator Type Layout
) Detach the indicator layout.
Select the check box for the indicator layout you want to detach.
Click
Detach
.
When the layout is detached, you can also edit the layout in the Indicator Type tab.
Edit the indicator type layout.
Select the indicator type whose layout you want to edit and click the layout.
You are presented with the current layout, which is populated with demo data so you can see how the fields fit.
In the
Indicator Summary
tab, customize the tabs.
Drag and drop the tab to reorder the tabs.
Configure the tabs by clicking the settings cog wheel icon in the tab and then select one of the following options.
Rename
Duplicate
Delete
Hide
Viewing Permissions
When clicking Viewing permissions, select which roles can view the tabs.
You can also decide whether you want each tab to appear in the Mobile App, by selecting the
Show this tab on Cortex XSOAR mobile App if role allows
checkbox. If selected, you can
Hide this tab on Cortex XSOAR web
.
Add sections to the layout.
From the Library section, in the Cortex XSOAR Sections drag and drop the required sections as follows:
Section	Description
New Section	After creating a new section, click the <Indicator Type> Fields tab and drag and drop the fields as required.
Cortex XSOAR out of the box sections	Out of the box sections such as Expiration Status, Reputation, and so on.
General Purpose Dynamic Section	Enables you to Add a Script in the Indicator Layout. For example, assign a script that determines and displays the Geo location of an IP address on a map. You can Set up Google Maps in Cortex XSOAR to use map automations.
Define the section properties by clicking and then
Edit section settings
.
You can determine how a section in the layout appears in the layout. For example, does the section include the section header or not. You can also configure the fields to appear in rows or as cards. For example, if you know that some of the field values will be very long, you are better off using rows. If you know that the field values are short, you might want to use cards so you can fit more fields in a section.
To remove or duplicate a section, select the section, click and select the relevant option.
Drag and drop fields, as required.
Add fields and custom buttons.
To add a custom button, you need to create an automation and then add the buttons to the layout using the automation. These buttons can simplify and assist an analyst in carrying out various tasks. For example, create a button to run an enrichment script on an identified indicator. After indicators are identified, click the Actions button and run an enhancement script directly on an indicator.
In the following example we want to create a button, which adds the indicator to a Hunt incident type, so the Threat Intel team can review it.
Select
Automation
New Automation
and add the following script:
commonfields:
  id: d3716514-4c2b-453c-8072-4fd4807bca0a
  version: 30
vcShouldKeepItemLegacyProdMachine: false
name: newIncidentFromIndicator
script: |+
  from pprint import pformat

  args = demisto.args()

  fields = {}
  fields['type'] = args['type']
  fields['details'] = args['indicator']['value']
  fields['name'] = args['type'] + " for " + args['indicator']['value']

  res = demisto.executeCommand('createNewIncident', fields)



  newID = res[0]['EntryContext']['CreatedIncidentID']

  demisto.executeCommand("associateIndicatorsToIncident", {"indicatorsValues": args['indicator']['value'], "incidentId":int(newID)})


type: python
tags:
- indicator-action-button
enabled: true
args:
- name: type
  required: true
  description: Incident Type
scripttarget: 0
subtype: python3
pswd: ""
runonce: false
dockerimage: demisto/python3:3.8.5.11789
runas: DBotWeakRole
From
Incident Layout Builder
Fields and Buttons
tab, drag the
+New Button
and drop into the relevant section.
Click to configure
.
Enter a descriptive name for the button, select a color, and select the script we added above.
In the
type
field, add
Hunt
.

Click
Save
.
In the Summary tab of the Indicator page, you can see the new button:

When you click the button, an incident is created with the Hunt incident type.
Add required sections and fields in the
Quick View
tab.
Add the layout to the indicator.
Go to the
Indicator Types
tab.
Select the indicator type and click
Edit
.
In the
Layout
field, from the drop down list, add the customized layout.
(
Optional
) For a customized layout, you can contribute it to the Marketplace.
In the
Layouts
page, select the layout and then click
Contribute to Marketplace
.
In the dialog box select either
Save and submit your contribution
or
Save and download your contribution
for later use, which you can view in the
Contributions
tab in the Marketplace.
If you select
Save and submit your contribution
your layout is validated and then you prompted to submit to review. You can also view your contribution in the Marketplace.