Customize indicator types, fields, and layouts - Threat Intel Management Guide - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR provides out-of-the-box indicator types, fields, and layouts. However, you may need to customize indicators to suit your use case, either by editing existing indicator types, fields, or layouts or by creating new ones to help investigate and respond to potential security threats specific to your organization.

Custom indicators can provide more accurate and efficient identification of potential cyber security threats. For example, you can customize indicators to monitor and detect unusual activity within your organization's internal network. This can include creating indicators to flag unauthorized access attempts or unusual data transfers, or identifying insider threats or compromised accounts.

Before customizing an indicator, review the ingested indicator and then customize it as needed. After ingesting incidents and indicators, check the indicator information associated with your incident. From an incident, review the context data (from Side panels). If there is information in the context data that you don't see in the indicator, map it into indicator fields and display it in the layout.

You can customize the following: