After configuring your fields and incident types, it is important to build or customize the layout to ensure that you are seeing the information that is germane to the incident type. For example, for a phishing incident you will want to see email headers, which would not be relevant for an access incident. Additionally, while some information might be relevant for multiple incident types, its location in one incident type might require more prominence than in another incident type.
You can customize almost every aspects of the layout, including, but not limited to:
- which tabs appear
- in which order do they appear
- who has permissions to view the tabs
- which information appears and how is it displayed
You can add dynamic sections to a layout, such as a graph of the number of bad indicators, their source, and severity. Also, you can use queries to filter the information in the dynamic section to suit your exact needs.
Customize an Incident Type Layout
Navigate to Settings -> Advanced -> Incident Types.
Select the incident type whose layout you want to edit and click Edit Layout. You are presented with the current layout, which is populated with demo data so you can see how the fields fit.
(Optional) Drag and drop the tabs to reorder their appearance. For example, drag the War Room so it appears after the Work Plan. You can also click +New tab to add a tab that currently does not exist.
Manage general settings for a tab
You can configure which tabs appear and for whom, as well as duplicate or remove tabs from the layout.
Hover over the tab that you want to configure.
Click the gear icon.
You are presented with the following options:
Viewing Permissionsa. To limit the roles for whom the tab appears, click **Viewing Permissions**.b. Select the role(s) who can view the tab and click **Save**.
Define Section Properties
You can determine how a section in the layout appears in the layout. For example, does the section include the section header or not. You can also configure the fields to appear in rows or as cards. For example, if you know that some of the field values will be very long, you are better off using rows. If you know that the field values are short, you might want to use cards so you can fit more fields in a section.
To remove or duplicate a section, or change its properties:
Click the section title. In the image above, that is Timeline Information.
Click the pencil icon and select the relevant option.
To change the information that appears in dynamic sections:
Click the section title. For example, Indicators.
Click the pencil icon and select Edit section settings.
Under Query, enter the parameters by which you want to filter the information that appears.
For example, to see all indicators of type IP and with a reputation of Bad that were found by a specific feed since March 1st 2020, enter Type:IP and reputation:Bad and firstseenbyfeed:>="2020-03-01T00:00:00 +0200".
Add New Sections or Fields to a Layout
You can add new sections or fields to the layout by dragging and dropping them from the Library on the left into the layout. For example, insert a new field that you created into a new, or already existing, section.