Create Custom Fields for the Phishing Layout - Tutorials - 6.x - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR 6.x Tutorials
Product
Cortex XSOAR
Version
6.x
Creation date
2022-10-13
Last date published
2023-06-05
Category
Tutorials

You are now familiar with the out-of-the-box phishing layout, but you can also create custom fields to add to the phishing layout. You can view and edit all existing out of the box fields in the fields table.

In this example we create the following fields:

Field Name

Field Type

Comments/Values

Was an anonymous email service used?

Boolean (checkbox)

Actors using anonymous emails. We will add this to the Case info tab and when creating or editing an incident.

Was a link clicked?

Boolean (checkbox)

We will add this to the Case info tab and when creating or editing an incident.

Was there a High Value Target?

Boolean (checkbox)

We will add this to the Case info tab and when creating or editing an incident.

Sensitivity

Short text

We will add this to the Case info tab and when creating or editing an incident.

Sensitivity refers to the classification level of the email, set by the user sending the email, if the email contains sensitive content.

  1. Go to Settings → OBJECTS SETUP → Incidents → Incident Fields.

  2. Create the Boolean fields, such as Was there a High Value Target?

    1. Click New Field.

    2. In the Field Type field, select Boolean (checkbox).

    3. In the Field Name field, type the name you want to use, such as High Value Target.

      By default, this field is available for all incident types. To choose specific incident types, deselect the checkbox for Add to all Incident types and select the desired incident type(s) from the dropdown menu.

    4. Click Save.

    5. Repeat for the other Boolean fields.

  3. Create the short text field.

    1. Click New Field.

    2. In the Field Type field, select Short text.

    3. For Field Name field, type Sensitivity.

    4. Click Save.

Note

You can also add existing incident fields, either out-of-the-box fields or fields from other content packs, to your Phishing incident layout. For example, if you wanted to include the User field from the Malware content pack in your Phishing incident layout, you would edit the User field and add Phishing from the Add to Incident types dropdown. The field would then be available to add to your Phishing incident layout.