Create a Grid Field for an Incident Type - Administrator Guide - 6.5 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.5
Creation date
2022-09-28
Last date published
2024-11-12
End_of_Life
EoL
Category
Administrator Guide
Abstract

Create custom incident grid fields to view and edit a table when adding it to an incident. Add grid field to an incident type in Cortex XSOAR.

The grid field enables you to view and edit a table when adding it to an incident. You can create a grid field and add it to an incident type.

  1. Select SettingsOBJECTS SETUPIncidentsIncident FieldsNew Field.

  2. From the New Incident Field window, in the Field Type field, from the drop down list, select Grid (table).

  3. Complete the following parameters:

    Parameter

    Description

    Field Name

    A meaningful name for the grid field.

    Tooltip

    (Optional) A brief descriptive message that explains what the field is and how to use it.

    User can add rows

    (Optional) Enables users to add/remove rows in the grid.

  4. In the Grid tab, add or remove the required rows and columns.

    How you design the grid determines how it appears to users. If users can add rows, they can add rows, but not columns.

  5. Configure each column by selecting the required field types, such as short text, boolean, URL, etc., for each column. You can move the columns, rename, add values, etc.

    If you select the Lock checkbox, the value for that field is static (not editable). If you do not select the Lock checkbox (default), users can perform in-line editing.

    column-settings.png
  6. In the Attributes tab, add the attribute parameters.

    For example, add the emailFieldTriggered script to run, which runs after the incident updates tag is stored in the database (unchecked). Make the field available to Access, Malware, and Network incident types.

    new-grid-3-6-9.png
  7. Click Save.