We are going to add both custom fields and existing out-of-the-box fields to the phishing layout.
To edit an incident layout, the layout must be detached or you must duplicate the incident type and edit the copy. When an incident type is detached, it no longer receives updates to the incident type from the related content pack. If you want to receive updates, duplicate the incident type instead of detaching it. The original incident type continues to receive updates, in this case, but the duplicate does not.
Go to → → → .
Select the Phishing Incident v3 layout checkbox.
Click Detach.
Select the Phishing Incident v3 layout and click Edit.
In the Case info tab, add the custom fields.
We can add these custom fields to any section. In this example, we want to create a new section.
From the Library section, in the Sections tab, drag and drop the New Section onto the Case info tab.
Rename the section to Additional Email Information, by clicking the pencil icon and selecting Edit section settings.
In the Fields and Buttons tab, drag and drop the custom buttons we have created.
Add existing system fields.
Drag and drop the XSOAR Read Only Roles field to the existing Case Basic Details section,
In the planning stage, we identified the need to add a read only button for a phishing incident. This allows analysts to restrict access to the incident to read-only.
Click the “New”/”Edit” Form tab, add the custom fields, as required. You can see below we have added the fields to the Incident Metadata section.
Click Save Version.
This enables you to restore any changes made. You have the option to include a note about your changes.