Add a Custom Widget to the Incident Page - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Add a custom widget when viewing an incident in Cortex XSOAR.

You can add a custom widget in the Incident info tab to incident types when you view a detailed incident. Every time you open the incident you can see the widget.

In the following example, we will add the Indicator Widget Bar to all Phishing incident types in the Incident info tab. This widget shows the severity of indicators in an incident, as a bar chart.

  1. Install the Identity Lifecycle Management - Core content pack.

    The content pack includes the IndicatorWidgetBar.

  2. Copy the Phishing incident layout.

    1. Select Settings & InfoSettingsObject SetupIncidentsLayoutsPhishing Incident.

    2. Click Duplicate.

      A copy of the Phishing indicator type appears, called Phishing Incident_copy.

    3. Click Phishing Incident_copy.

    4. Drag and drop the General Purpose Dynamic Section into the layout area.

    5. Edit the General Purpose Dynamic Section by adding the name and the script created in step 1.

    6. Click Save.

  3. Add the Phishing Incident_copy layout to the Phishing incident type.

    1. Select Settings & InfoSettingsObject SetupIncidentsTypesPhishing.

    2. From the Edit Incident Type dialog box, in the Layout field, from the dropdown list, add Phishing Incident_copy.

    3. Click Save.

  4. View the Indicator Widget Bar in a phishing incident.

    1. Go to the Incidents page.

    2. Select an incident with incident type Phishing.

      In the Incident Info tab you can see the Incident Widget Bar.