Create or detach a Threat Intel Report type to suit your use case.
Threat intel reports are categorized by type, which determines the layout that is displayed for the report.
You can create new threat intel report types to support use cases not covered by the out-of-the-box types, which may require different report layouts. For example, you may want to add a new type for a specific threat-hunting report that your organization needs, which is not covered by one of the out-of-the-box template types.
If you want to customize a report type by attaching a new layout, you need to detach the existing report type. If you detach it, it does not receive content pack updates. If you reattach it, any content pack updates override any changes made.
Note
If you disable the report, it is not available for selection when you create a report.
You cannot delete out-of-the-box report types.
Before creating a Threat Intel Report type, review, customize, or create a new layout, which is then added to the report type.
Select → → → → → .
Enter a name and select the layout you want to use.
You can leave this blank and add the layout later.
(Multi-tenant only) Add or select Propagation labels. You can also view any dependencies.
Save the type.