Customize an indicator layout for an indicator type in Cortex XSOAR. View the layout in the indicator Summary and Quick View.
Each indicator type has a unique set of data relevant to that specific indicator type, including layouts. It is important to display the most relevant data for users. Each out-of-the-box indicator comes with a layout. You can customize almost every aspect of the layout, including which tabs appear, in which order they appear, who has permission to view the tabs, what information appears, and how it is displayed.
You can see which indicator type uses the indicator layout in the Types tab under → → → . The indicator layout name appears in the Layout column.
You can customize the display information including fields for existing indicators, by modifying the sections and fields for the following views:
Section | Description |
|---|---|
Indicator Summary | You can customize almost every aspect of the layout, including which tabs appear, the order they appear, and who has permission. In each field or tab, you can add filters by clicking the eye icon, which enables you to add conditions that show specific fields or tabs relevant to the indicator. You can add a script in the indicator layout, such as a mapping script, which determines where an IP address originates and displays it on a map. NoteOnly available if you have a TIM license. |
Quick View | Add, edit, and delete sections, fields, and filters in the Quick View section from an incident. |
"New"/"Edit" form | Add, edit, and delete fields and buttons to be displayed when creating or editing an indicator. |
Note
By default, when editing a list or text values in an incident/indicator layout, the changes are not saved until you confirm your changes (clicking the checkmark icon in the value field). These icons are designed to give you additional security when updating fields in incidents and indicators.
You can change this default behavior by adding a server configuration. For more information, see Configure inline value fields.
Create or edit a layout.
From the Sections tab in the Library, drag and drop the following sections:
Section
Description
New Section
After creating a new section, click the Fields and Buttons tab and drag and drop the fields as required.
Cortex XSOAR out-of-the-box sections
Out-of-the-box sections such as Expiration Status and Verdict.
General Purpose Dynamic Section
You can add a script in the indicator layout. For example, to assign a script that determines and displays the Geolocation of an IP address on a map. For more information, see Set up Google Maps.
Note
To remove or duplicate a section, select the section, click
and then select Duplicate, or Remove.Define the section properties, by clicking
and then Edit section settings.Tip
Limit the number of incident fields to 50 in each section. You can create additional sections as needed.
You can determine how a section in the layout appears in the layout. For example, you may want a section header, or configure the fields to appear in rows or as cards. If some of the field values will be very long, use rows instead of cards. If the field values are short, you might want to use cards so you can fit more fields into a section.
Drag and drop fields, and add any filters as required.
If relevant, create a new tab and repeat the steps as required.
You can add content to the Indicator Summary tab, based on a script, by adding the script in the General Purpose Dynamic Section. The script can return simple text, markdown, or an HTML, the results of which appear in the General Purpose Dynamic Section.
You can add any required information from a script. For example:
Add a mapping script that determines where an IP address originates and displays it on a map.
Add a custom widget to the indicator page. The procedure is similar for indicators and incidents.
Add the FeedRelatedIndicator script from the Scripts page, which contains information about the relationship between an indicator, entity (such as malware), and other indicators (such as a MITRE ATT&K indicator), and connects externally to those indicators, if relevant.
Before you begin, you need to create a script.
Note
Ensure that you have added the dynamic-indicator-section tag, otherwise, you can't select it when adding a script
Go to → → → → .
Click on the indicator layout you want to edit.
The layout must either be custom content (a layout you created), a layout duplicated from a content pack layout, or a detached layout from a content pack. You cannot edit a layout that is attached. To detach an attached layout, select the indicator layout and click Detach. The layout must either be custom content (a layout you created) or a detached layout from a content pack. You cannot edit a layout that is attached.
Drag and drop the General Purpose Dynamic Section onto the page.
Select the General Purpose Dynamic Section, click
, and then click Edit section settings.In the Name and Description fields, add a meaningful name and a description for the dynamic section that explains what the script displays.
In the Automation script field, select the script that returns data for the dynamic section.
Click OK.
You can add existing buttons or create buttons and then drag and drop them in the layout.
To add a custom button, create a script and then add the new button to the indicator layout and choose the script, as described in the example below. These buttons can simplify and assist an analyst in carrying out various tasks. For example, you can create a button to run an enrichment script on an identified indicator.
For fields (script arguments) that are optional, you can define whether to show them to analysts when they click on buttons. To expose an optional field, select the Ask User checkbox next to the script arguments in the button settings page.
Note
When creating a script for use in an indicator layout, the indicator-action-button tag must be assigned for the script to be available for custom buttons.
In the following example, create a button that adds the indicator to a Hunt incident type so the Threat Intel team can review it.
Save the following script on your computer. On the Scripts page, click the upload script icon and upload the file.
commonfields: id: d3716514-4c2b-453c-8072-4fd4807bca0a version: 30 vcShouldKeepItemLegacyProdMachine: false name: newIncidentFromIndicator script: |+ from pprint import pformat args = demisto.args() fields = {} fields['type'] = args['type'] fields['details'] = args['indicator']['value'] fields['name'] = args['type'] + " for " + args['indicator']['value'] res = demisto.executeCommand('createNewIncident', fields) newID = res[0]['EntryContext']['CreatedIncidentID'] demisto.executeCommand("associateIndicatorsToIncident", {"indicatorsValues": args['indicator']['value'], "incidentId":int(newID)}) type: python tags: - indicator-action-button enabled: true args: - name: type required: true description: Incident Type scripttarget: 0 subtype: python3 pswd: "" runonce: false dockerimage: demisto/python3:3.8.5.11789 runas: DBotWeakRoleWhen uploading to Cortex XSOAR the newIncidentFromIndicator name and the indicator-action-button is already populated.
Go to → → → → and click the relevant indicator type layout.
From the Fields and Buttons tab, drag the +New Button and drop into the relevant section.
Click to configure.
Enter a descriptive name for the button. For this example, we call it
Send to the Threat Hunt Team.Select a color.
Select the script we added above:
newIncidentFromIndicator.In the Script Arguments field, under the type field, add Hunt.
Save the button.
When you view an indicator and click this button, an incident is created with the Hunt incident type.
To test the button, add the layout to the indicator type, go to the Threat Intel (Indicators) page, create a new indicator, and assign it to the relevant indicator type. View the indicator, click the Pass to Threat Hunt Team button, and verify that a new incident has been created.