Create custom case fields - Create case fields so you can add them to custom case layouts. - Administrator Guide - Cortex XSIAM - Cortex

Create custom case fields - Create case fields so you can add them to custom case layouts. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-11

Category

Administrator Guide

Abstract

Create case fields so you can add them to custom case layouts.

Create case fields so you add them to custom case layouts.

You can create custom case fields to:

Map raw JSON fields from incoming issues.
Display custom fields data in the Cases table.
Create correlation rules that generate issues from XQL queries and map the output of the queries to custom case fields.
Design custom case layouts that include custom case fields.

How to create a new custom case field:

Select Settings → Configurations → Object Setup → Cases → Fields → New Field.
Choose a field type and enter a field name. You can add an optional tooltip to provide users with information about the field.
If adding a grid, see Create a grid field for a case.
Save your changes.

Custom case fields can be exported and imported. To export a single custom case field, right-click on the field in the fields table, and select Export. To export all custom case fields in a single JSON file, click the Export All button above the fields table.

After a custom case field is created, it can be edited, deleted, or exported by right-clicking on the row. The field name and field type cannot be changed after the field is created.