Incident layout - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM includes default incident layouts. Additional incident layouts can be added by installing content packs, duplicating incident layouts, or creating new custom incident layouts.

The default incident layouts and any layouts that are added from content packs, are locked by default and cannot be deleted, edited, exported or duplicated.

To modify an existing custom layout, go to Settings → Configurations → Object Setup → Incident → Layouts , right-click the layout in the layouts table, and select Edit, Duplicate, Delete, or Export.