Create a Widget From an Incident - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Create a custom widget from an incident search in Cortex XSOAR.

Although there are various out-of-the-box system widgets available, you can create custom widgets from incidents and then add them to a dashboard or report. You can also create a widget in the widgets library.

To create a widget from an incident, you need to run a query from the Incidents page and then save the visual results as a widget. For an example, see Create a Widget From an Incident Example.

  1. In the Incidents page, from the dropdown list select the date range.

  2. In the query field, type the query criteria as required and run the query.

  3. Click create-widget-2.png.

  4. Follow the procedure in Create a Widget Using the Widget Builder.

  5. Click Save.

    The widget is added to the Widgets Library.


    By default, the widget inherits the date range that you specify when creating the widget, but you can modify the date range when you create the dashboard or report. If the date range for the report or dashboard does not include the widget date range, the data is blank. To override the dashboard or report’s date range, click Use Widget’s date range.