Customize incident layouts in Cortex XSOAR to view relevant information.
Each incident type has a unique set of data relevant to that specific incident type, including layouts. It is important to display the most appropriate data for users. Each out-of-the-box incident comes with a layout. You can customize almost every aspect of the layout, including which tabs appear, in which order they appear, who has permission to view the tabs, what information appears, and how it is displayed.
It's important to build or customize the layout so that you see the information that is relevant to the incident type. For example, in a phishing incident, you may want to see email headers, but not in an access incident. While some information might be appropriate for multiple incident types, its location in one incident may require more prominence than in another incident.
You can see which incident type uses the incident layout in the Types tab under → → → . The incident layout name appears in the Layout column. You can edit the layouts in the Layouts tab.
You can customize the display information including fields for existing incidents, by modifying the sections and fields for the following views:
Section | Description |
|---|---|
Incident Summary | The Incident Summary tab displays the information necessary to investigate an incident. You can customize almost every aspect of the layout, including which tabs appear, the order they appear, and who has permission. In each field or tab, you can add filters by clicking on the eye icon, which enables you to add conditions that show specific fields or tabs. For example, if an analyst decides that a Cortex XDR Malware incident is a Ransomware subtype, they may only want fields to appear that show data about the encryption method and not to show information if the Malware subtype is adware.  You may also want to limit specific tabs to certain scenarios. For example, if a user clicks a phishing link, the new tab can contain relevant fields and action buttons for this scenario. You can also add dynamic fields, such as a graph of several bad indicators, their source, and severity. For more information, see Create dynamic fields. Also, you can use queries to filter the information in the dynamic section to suit your exact needs. |
New/Edit form | Add, edit, and delete fields and buttons to be displayed when creating or editing an incident. |
Close Form | Add, edit, or delete sections, fields, and filters, when closing an incident. |
Incident Quick View | Add, edit, and delete sections, fields, and filters in the Incident Quick view section in the incident. |
Note
There are several out-of-the-box layout sections and fields that you cannot remove, but you can rearrange them in the layout and modify their queries and filters. These layouts need to be duplicated or detached to make changes.
We recommend copying an existing out-of-the-box incident layout so you don't miss any important information.
Create or edit a layout.
From the Sections tab in the Library, drag and drop the following sections:
Section
Description
New Section
After creating a new section, click the Incident type Fields tab and drag and drop the fields as required.
Cortex XSOAR out-of-the-box sections
Out-of-the-box sections such as attachments and evidence.
General Purpose Dynamic Section
You can add a script to the incident layout. For example, assign a script that calculates the total number of entries that exist for an incident, which dynamically updates when new entries are added to the incident.
Note
To remove or duplicate a section, select the section, click
, and then select Duplicate or Remove.Define section properties by clicking
and then Edit section settings.Tip
Limit the number of incident fields to 50 in each section. You can create additional sections as needed.
You can determine how a section in the layout appears in the layout. For example, you may want a section header, or configure the fields to appear in rows or as cards. If some of the field values will be very long, use rows instead of cards. If the field values are short, you might want to use cards so you can fit more fields into a section.
To add a long description in the Description field, click Scrollable description to add a scrollbar to enable the displayed information to grow to fit the content.
If adding the Malicious or Suspicious Indicators section, you can change the information that appears, by editing the Query.
For example, to see all indicators of type IP and with a reputation of Bad that were found by a specific source since January 2nd 2022, enter
Type:IP and reputation:Bad and firstseenbysource:>="2021-01-02T00:00:00 +0200"Drag and drop fields, and add any filters as required.
If relevant, create a new tab and repeat the steps as required.
You can add script-based content to the incident layout by adding the General Purpose Dynamic Section in the incident layout builder. The General Purpose Dynamic Section enables you to configure a section in the incident layout from a script. The script can return a simple text, markdown, or HTML, the results of which appear in the General Purpose Dynamic Section.
You can add any required information from a script. For example, you can assign a script that calculates the total number of entries for an incident, which dynamically updates when new entries are added to an incident. You can add a custom widget to the incident page and add note information using a script.
The following are examples of values that can be returned from the General Purpose Dynamic Section script:
Text example
return_results(<TEXT>)
Markdown example
return_results({
'ContentsFormat': EntryFormat.MARKDOWN,
'Type': EntryType.NOTE,
'Contents': <MARKDOWN_DATA>
})HTML example
return_results({
'ContentsFormat': EntryFormat.HTML,
'Type': EntryType.NOTE,
'Contents': <HTML_DATA>
})For the EntryFormat values see EntryFormat in Common Server Python functions.
Before you begin, you need to create a script.
Create a script.
For examples of script-based widgets for layouts, see Examples of using scripts in incident layouts
Add the
dynamic-sectiontag.Create or edit an incident layout.
Drag and drop the General Purpose Dynamic Section into the layout area you want to appear.
Select the General Purpose Dynamic Section, click
and then click Edit section settings.In the Name and Description fields, add a meaningful name and a description for the dynamic section that explains what the script displays.
In the Automation script field, from the dropdown list, select the script that returns data for the dynamic section.
Note
Only scripts to which you have added the
dynamic-sectiontag appear in the dropdown list.Save the section.