Customize Incident Layouts

Go to
Settings
OBJECTS SETUP
Incidents
Layouts
.
(
Content Pack Incident Type
) Detach the incident layout.
Select the check box for the incident layout you want to detach.
Click
Detach
.
When the layout is detached, you can also edit the layout in the
Incident Type
tab.
Edit the incident type layout.
Select the incident type and click the layout.
You are presented with the current layout, which is populated with sample data so you can see how the fields fit.
In the
Incident Summary
tab, customize the tabs.
Drag and drop the tab to reorder the tab. For example, you can move the War Room tab so it appears after the Work Plan tab.
Configure the tabs by clicking the settings cog wheel icon in the tab and then select one of the following options.
Rename
Duplicate
Delete
Show Empty Fields
The setting that you configure in the layout becomes the default value seen in the incident for the specific tab, which can then be overridden. You can also set a global default value using the
UI.summary.page.hide.empty.fields
server configuration, which can also be overridden for a specific tab.
Hide Tab
Format for exporting
Build your layout based on A4 proportions to match the format used for exporting. Selecting this option hides the tab by default, but the tab will remain available for export.
Viewing Permissions
When clicking Viewing permissions, select which roles can view the tabs.
Display Filter
: Enables you to add or view any filter applied to the tab. If the filters apply, the specific fields or tabs are shown in the layout. If the mandatory field is not shown in the layout, the user is not obliged to complete it.
Not all of the options are available for each tab.
Add sections to the layout.
From the Library section, in the Cortex XSOAR Sections drag and drop the following required sections:

Section	Description
New Section	After creating a new section, click the <Incident Type> Fields tab and drag and drop the fields as required.
Cortex XSOAR out-of-the-box sections	Out-of-the-box sections such as Attachments, Evidence, and so on.
General Purpose Dynamic Section	Enables you to assign a script to this section. For example, assign a script that calculates the total number of entries that exist for an incident, and it dynamically updates when new entries are added to the incident.

Define section properties.

You can determine how a section in the layout appears in the layout. For example, does the section include the section header or not. You can also configure the fields to appear in rows or as cards. For example, if you know that some of the field values will be very long, you are better off using rows. If you know that the field values are short, you might want to use cards so you can fit more fields in a section.

Select the section, click and then click

Edit section settings

.

Edit the section as required and click

OK

.

To remove or duplicate a section, select the section, click and then select

Duplicate

or

Remove

.

If adding the

Malicious or Suspicious Indicators

section, you can change the information that appears, by clicking , selecting

Edit section settings

and then editing the

Query

.

For example, to see all indicators of type IP and with a reputation of Bad that were found by a specific source since January 2nd 2022, enter

Type:IP and reputation:Bad and firstseenbysource:>="2021-01-02T00:00:00 +0200"


Drag and drop fields and add any filters, as required.
Add any custom buttons.
To add custom buttons, you need to create an automation and then add the buttons to the layout using the automation. These buttons can simplify and assist an analyst in carrying out various tasks. For example, add buttons for an analyst to self-assign an incident, link or unlink an incident, close an incident as a duplicate, generate a summary report, etc.
For fields (script arguments) that are optional, you can define whether to show them to analysts when they click on buttons. To expose an optional field, select the
Ask User
checkbox next to the script argument/s in the button settings page.
The script that runs when an action button is clicked accepts only mandatory arguments through the pop up window and does not provide an option for any non-mandatory arguments to be filled in when the button is clicked. It is recommended to use a wrapper script to collect and validate arguments in scenarios where there can be a combination of mandatory and non-mandatory arguments for a button.
In the following example, we will add a button to self assign an incident for an analyst. The automation is included in the
Case Management - Generic
Content Pack.
Drag the

+New Button

and drop into the relevant section.

Click to configure

.

Enter a descriptive name for the button, select a color, and select the script that you want to run when the button is clicked.



Click

Save

.

In the

Incident Summary

tab, when clicking on

Assign To Me

, the incident will be self-assigned.


Add required sections and fields in the
New/Edit Form
,
Close Form
, and
Incident Quick View
tabs.
If you have created a new or a duplicate of the layout, add the layout to the incident.
Go to
Settings
OBJECTS SETUP
Incidents
Types
.
(
Content Pack Incident Types
) Detach or duplicate the incident type.
Select the incident type and click
Edit
.
In the
Layout
field, from the drop down list, add the customized layout.
Create or ingest an incident to test the new layout and verify fields are populated.
(
Optional
) For a customized layout, you can contribute it to the Marketplace.
In the
Layouts
page, select the new layout and then click
Contribute
.
In the dialog box select either
Save and submit your contribution
or
Save and download your contribution
for later use, which you can view in the Contributions tab in the Marketplace.
If you select
Save and submit your contribution
your layout is validated and then you prompted to submit to review. You can also view your contribution in the Marketplace.