Issue layouts - View system layouts or create custom layouts for your issue type. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM includes default issue layouts. You can add additional issue layouts by installing content packs, duplicating system issue layouts, or creating new custom issue layouts. Issue layouts are applied to incoming issues based on issue layout rules.

Issue layouts control the information displayed in the Investigate panel. To see the issue layout that has been applied, in the Issue investigation panel click the Layout Info button in the upper right corner. Empty layout fields are hidden by default, but are shown if you select Show empty fields.

The default issue layouts and any layouts that are added from content packs, are locked by default and cannot be deleted, edited, or exported. To view a system layout, right-click the layout row and select View. If you want to edit a system layout, you can detach or duplicate the layout by right-clicking the layout row in the issue layout table and selecting Detach or Duplicate. If you detach a layout, the layout does not receive content updates until it is reattached. To reattach a system layout, right-click the layout row and select Attach. If you detach a layout and make changes, those changes may be overwritten if you later reattach the layout. If a layout is detached, you can edit or duplicate it, but you cannot delete or export it. If you instead duplicate the issue layout, the new duplicated layout can be edited, deleted, or exported, the same as a custom issue layout.

When viewing an issue, most issue fields can be edited inline, by users with editing permissions. After editing a field inline, click the check mark to save your change. Some system fields, such as Source Instance, cannot be edited.

To modify an existing custom layout, go to Settings → Configurations → Object Setup → Issues → Layouts, right-click the layout in the layouts table, and select Edit, Duplicate, Delete, or Export.