Customize an Indicator Type Layout - Threat Intel Management Guide - 6.8 - Cortex XSOAR - Cortex - Security Operations

Go to Settings → OBJECTS SETUP → Indicators → Layouts.

(Content Pack Indicator Type Layout) Detach the indicator layout.

1. Select the checkbox for the indicator layout you want to detach.

2. Click Detach.

   When the layout is detached, you can also edit the layout in the Indicator Type tab.

Edit the indicator type layout.

1. Select the indicator type layout and click Edit.

   You are presented with the current layout, which is populated with demo data so you can see how the fields fit.

In the Indicator Summary tab, customize the tabs.

1. Drag and drop the tab to reorder the tabs.

2. Configure the tabs by clicking the settings cog wheel icon in the tab and then select one of the following options.

   • Rename

   • Duplicate

   • Delete

   • Show Empty Fields

     The setting that you configure in the layout becomes the default value seen in the indicator for the specific tab, which can then be overridden. You can also set a global default value using the UI.summary.page.hide.empty.fields server configuration, which can also be overridden for a specific tab.

   • Hide tab

   • Format for exporting

     Build your layout based on A4 proportions to match the format used for exporting. Selecting this option hides the tab by default, but the tab will remain available for export.

   • Viewing Permissions

     When clicking Viewing permissions, select which roles can view the tabs.

   • Display Filter

     Enables you to add or view a filter applied to the tab. If the filters apply, the specific fields or tabs are shown in the layout. If the mandatory field is not shown in the layout, the user is not obliged to complete it.

Add sections to the layout.

1. From the Library section, in the Cortex XSOAR Sections drag and drop the required sections as follows:

   Section	Description
   New Section	After creating a new section, click the <Indicator Type> Fields tab and drag and drop the fields as required.
   Cortex XSOAR out-of-the-box sections	Out-of-the-box sections such as Expiration Status, Verdict, etc.
   General Purpose Dynamic Section	Enables you to Add a Script in the Indicator Layout. For example, assign a script that determines and displays the Geo location of an IP address on a map. You can Set up Google Maps in Cortex XSOAR to use map automations.

2. Define the section properties, by clicking and then Edit section settings.

   You can determine how a section in the layout appears in the layout. For example, does the section include the section header. You can also configure the fields to appear in rows or as cards. For example, if you know that some of the field values will be very long, you are better off using rows. If you know that the field values are short, you might want to use cards so you can fit more fields in a section.

3. To remove or duplicate a section, select the section, click and then select Duplicate, or Remove.

Drag and drop fields, and add any filters as required.

Add any custom buttons.

To add a custom button, create an automation and then add the New Button to the indicator layout and choose the automation, as described in the example below. These buttons can simplify and assist an analyst in carrying out various tasks. For example, you can create a button to run an enrichment script on an identified indicator.

For fields (script arguments) that are optional, you can define whether to show them to analysts when they click on buttons. To expose an optional field, select the Ask User checkbox next to the script argument/s in the button settings page.

In the following example we want to create a button which adds the indicator to a Hunt incident type, so the Threat Intel team can review it.

1. Save the following script as a Python file on your computer. On the Automations page, click the upload automation icon and upload the file.

   commonfields:
     id: d3716514-4c2b-453c-8072-4fd4807bca0a
     version: 30
   vcShouldKeepItemLegacyProdMachine: false
   name: newIncidentFromIndicator
   script: |+
     from pprint import pformat
   
     args = demisto.args()
   
     fields = {}
     fields['type'] = args['type']
     fields['details'] = args['indicator']['value']
     fields['name'] = args['type'] + " for " + args['indicator']['value']
   
     res = demisto.executeCommand('createNewIncident', fields)
   
   
   
     newID = res[0]['EntryContext']['CreatedIncidentID']
   
     demisto.executeCommand("associateIndicatorsToIncident", {"indicatorsValues": args['indicator']['value'], "incidentId":int(newID)})
   
   
   type: python
   tags:
   - indicator-action-button
   enabled: true
   args:
   - name: type
     required: true
     description: Incident Type
   scripttarget: 0
   subtype: python3
   pswd: ""
   runonce: false
   dockerimage: demisto/python3:3.8.5.11789
   runas: DBotWeakRole
   

2. Go to Settings → OBJECTS SETUP → Indicators → Layouts and click on the relevant indicator type layout.

3. Drag the +New Button from the Fields and Buttons tab and drop into the relevant section.

4. Click to configure.

5. Enter a descriptive name for the button. For this example, we call it Pass to Threat Hunt Team. Select a color. Select the script we added above - newIncidentFromIndicator.

6. In the type field, add Hunt.

7. Click Save.

   In the Summary tab, you can see the new button:

   When you view an indicator and click this button, an incident is created with the Hunt incident type.

8. To test, go to the Threat Intel (Indicators) page, create a new indicator, and assign it to the relevant indicator type. View the indicator, click the Pass to Threat Hunt Team button, and verify that a new incident is created.

Add required sections and fields in the Quick View tab.

Add the layout to the indicator.

1. Go to Settings → OBJECTS SETUP → Indicators → Types.

2. Select the indicator type and click Edit.

3. In the Layout field, from the dropdown list, add the customized layout.

(Optional) For a customized layout, you can contribute it to the Marketplace.

1. In the Layouts page, select the new layout and then click Contribute.

2. In the dialog box select either Save and submit your contribution or Save and download your contribution for later use, which you can view in the Contributions tab in the Marketplace.

   If you select Save and submit your contribution your layout is validated and then you prompted to submit to review. You can also view your contribution in the Marketplace.