Create the Read-Only Incident Type and Layout - Administrator Guide - 6.9 - Cortex XSOAR - Cortex - Security Operations

Go to Settings → OBJECTS SETUP → Incidents → Types.

Create an Incident Type for the self-service read-only user. Be sure to configure the playbook to run automatically.

Select the Incident Type and click Edit Layouts.

Create a new incident tab dedicated to self-service read-only users.

Hover over the tab you want the self-service read-only user to view and click the gear icon.

Click Viewing Permissions.

In the Viewing Permissions window, select the Permit users with no roles to view this tab option.

Customize this incident tab to only include widgets with data read-only users can access. Such information can be Case Details, Timeline Information, Attachments, and War Room entries.

Test and validate this incident tab layout as a self-service read-only user to ensure it displays correctly and without an insufficient permission error message.