Customize Indicator View Layouts
Overview of the indicator view layout in Cortex XSOAR.
Indicator summary, Quick View.
The indicator Full View is not available for new customers
who have not purchased a TIM license.
Each indicator type has a unique set of data relevant
to that specific indicator type. It is important to display the
most relevant data for users.
For each indicator type, there are two views:
You can customize how the information is displayed for existing
indicators by modifying the sections and fields for each view.
You can access the Indicator quick view when you click an indicator
on an incident page or on the canvas.
By default, when editing the following inline values in a indicator,
the changes are not saved until you confirm your changes (clicking
the check mark icon in the value field).
These icons are designed to let you have an additional level
of security before you make changes to the fields in threat indicators,
incidents, and intel reports.
To change the default behavior set the
inline.edit.on.blur
server
configuration to
true
, which enables you
to make changes to inline fields without clicking the check mark.
The changes are automatically saved when clicking anywhere on the
page or when navigating to another page. For text values you can also
click anywhere in the value field to edit.
