Create a Grid Field for an Incident Type - Administrator Guide - 6.10 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Create custom incident grid fields to view and edit a table when adding it to an incident. Add grid field to an incident type in Cortex XSOAR.

The grid field enables you to view and edit a table when adding it to an incident. You can create a grid field and add it to an incident type.

  1. Select SettingsOBJECTS SETUPIncidentsIncident FieldsNew Field.

  2. From the New Incident Field window, in the Field Type field, from the dropdown list, select Grid (table).

  3. Complete the following parameters:



    Field Name

    A meaningful name for the grid field.


    (Optional) A brief descriptive message that explains what the field is and how to use it.

    User can add rows

    (Optional) Enables users to add/remove rows in the grid.

  4. In the Grid tab, add or remove the required rows and columns.

    How you design the grid determines how it appears to users. If the users can add rows field is selected, they can add rows, but not columns.

  5. Configure each column by selecting the required field types, such as short text, boolean, URL, etc., for each column. You can move the columns, rename, add values, etc.

    If you select the Lock checkbox, the value for that field is static (not editable). If you do not select the Lock checkbox (default), users can perform in-line editing.



    After creating and saving a Grid field, column field types (boolean, short text, single select, etc.) cannot be changed.

  6. In the Attributes tab, add the attribute parameters.

    For example, add the emailFieldTriggered script to run, which runs after the incident updates tag is stored in the database (unchecked). Make the field available to Access, Malware, and Network incident types.

  7. Click Save.