Add a custom widget to an issue layout - Add any widget to a custom issue layout. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Add the Indicator Widget Bar script to Cortex XSIAM.

1. Go to Investigation & Response → Automation → Scripts and upload the following script:

   Expand script

   commonfields:
     id: ee3b9604-324b-4ab5-8164-15ddf6e428ab
     version: 49
   name: IndicatorWidgetBar
   script: |-
     # Constants
     HIGH = 3
     SUSPICIOUS = 2
     LOW = 1
     NONE = 0
   
     indicators = []
     scores = {HIGH: 0, SUSPICIOUS: 0, LOW: 0, NONE: 0}
     incident_id = demisto.incidents()[0].get('id')
   
     foundIndicators = demisto.executeCommand("findIndicators", {"query":'investigationIDs:{}'.format(incident_id), 'size':999999})[0]['Contents']
   
     for indicator in foundIndicators:
         scores[indicator['score']] += 1
   
     data = {
       "Type": 17,
       "ContentsFormat": "bar",
       "Contents": {
         "stats": [
           {
             "data": [
               scores[HIGH]
             ],
             "groups": None,
             "name": "high",
             "label": "incident.severity.high",
             "color": "rgb(255, 23, 68)"
           },
           {
             "data": [
               scores[SUSPICIOUS]
             ],
             "groups": None,
             "name": "medium",
             "label": "incident.severity.medium",
             "color": "rgb(255, 144, 0)"
           },
           {
             "data": [
               scores[LOW]
             ],
             "groups": None,
             "name": "low",
             "label": "incident.severity.low",
             "color": "rgb(0, 205, 51)"
           },
           {
             "data": [
               scores[NONE]
             ],
             "groups": None,
             "name": "unknown",
             "label": "incident.severity.unknown",
             "color": "rgb(197, 197, 197)"
           }
         ],
         "params": {
             "layout": "horizontal"
         }
       }
     }
   
     demisto.results(data)
   type: python
   tags:
   - dynamic-section
   enabled: true
   scripttarget: 0
   subtype: python3
   runonce: false
   dockerimage: demisto/python3:3.7.3.286
   runas: DBotWeakRole
   								

2. Click Save.

Add the widget to an issue layout.

1. Go to Settings → Configurations → Object Setup → Issues → Layouts.

2. Create a new custom issue layout or right-click to open an existing custom issue layout or a detached or duplicated system layout.

3. Drag and drop the General Purpose Dynamic Section into a layout tab.

4. Edit the General Purpose Dynamic Section by clicking the pencil icon.

5. Enter a name for the section and choose the automation script you uploaded in Step 1.

6. Click Ok.