Add a Custom Widget to the Incident Page - Administrator Guide - 6.9 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
6.9
Creation date
2022-09-29
Last date published
2024-10-07
End_of_Life
EoL
Category
Administrator Guide
Abstract

Add a custom widget when viewing an incident in Cortex XSOAR.

You can add a custom widget in the Incident info tab to incident types when you view a detailed incident. Every time you open the incident you can see the widget.

The following example, shows how to add the Indicator Widget Bar to all Phishing incident types in the Incident info tab. This widget shows the severity of indicators in an incident, as a bar chart.

  1. Install the Identity Lifecycle Management - Core content pack.

    The content pack includes the IndicatorWidgetBar script.

  2. Copy the Phishing incident layout.

    1. Select Settings → OBJECTS SETUP → Incidents → Layouts → Phishing Incident

    2. Click Duplicate.

      A copy of the Phishing indicator type appears, called Phishing Incident_copy.

    3. Click Phishing Incident_copy.

      Layouts.png

    4. Drag and drop the General Purpose Dynamic Section into the layout area.

    5. Edit the General Purpose Dynamic Section by adding the name, and the script created in Step 2.

      gen_purpose_section.png

    6. Click Save.

  3. Add the Phishing Incident_copy layout to the Phishing incident type.

    1. Select Settings → OBJECTS SETUP → Incidents → Types → Phishing → Edit.

    2. From the Edit Incident Type dialog box, in the Layout field, from the dropdown list, add Phishing Incident_copy.

      incident-layout.png

    3. Click Save.

  4. View the Indicator Widget Bar in a phishing incident.

    1. Go to the Incidents page.

    2. Select an incident with incident type Phishing.

      In the Click the Incident Info tab you can see the Incident Widget Bar:

      incident-incident-info.png