Set and update incident fields - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Using a playbook to create incident fields offers a structured and automated approach to defining and populating fields with relevant data during incident handling. This ensures consistency in data collection, enhances the organization of incident information, and facilitates streamlined analysis and response processes.

Creating incident fields is essential for structuring and storing specific information related to security incidents. These fields enable efficient organization and retrieval of incident data, enhancing analysis, decision-making, and automated response actions. It is an iterative process in which you create fields as you better understand your needs and the information available in the third-party integrations you use. You initially define incident fields after the planning stage, with mapping and classification for how the incidents will be ingested from third-party integrations into Cortex XSOAR.

During the investigation, you can then use the setIncident script in a playbook task to set and update incident fields.

For more information on creating custom incident types and fields, see this video.