Edit Dbot Incident and Indicator Suggestions - Customize Dbot incident and indicator suggestions in the Canvas, using a Cortex XSOAR server configuration. - Administrator Guide - 6.9 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
6.9
Creation date
2022-09-29
Last date published
2025-10-27
End_of_Life
EoL
Category
Administrator Guide
Abstract

Customize Dbot incident and indicator suggestions in the Canvas, using a Cortex XSOAR server configuration.

In the Investigation Canvas, Dbot provides suggestions in the Entity Library section and the Quick View window. You can change these suggestions by adding keys and values when adding a server configuration.

  1. Select Settings → About → Troubleshooting → Add Server Configuration.

  2. Add the following keys and values as required:

    Key

    Description

    canvas.suggestions.IncidentIndicatorSuggestions.max

    Maximum number of suggestions for malicious suggestions. Default: 5

    Relevant for Library and Quick View.

    canvas.suggestions.IncidentMutualIndicatorSuggestions.max

    Maximum number of suggestions for common indicators between incidents. Default: 5

    Relevant for Library and Quick View.

    canvas.suggestions.IndicatorIndicatorSuggestions.max

    Maximum number of suggestions for indicators. Default: 5

    Relevant for Quick View.

    ml.suggestions.canvas.leftpane.incidents.limit

    Maximum number of incidents in the Quick View window. Default: 10

    Relevant for Quick View.