Incident layouts - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM includes default incident layouts. The default incident layouts and any layouts that are added from content packs, are locked by default and cannot be deleted, edited, exported or duplicated.

You can add customized incident layouts, of which you can Edit, Duplicate, Delete or Export. When creating or editing an incident layout, you can only add/edit tabs that you created. You cannot edit the default tabs that exist in the layout.