topic Re: War Room Table to Layout view in Cortex XSOAR Discussions

War Room Table to Layout view

MMagdic — Thu, 20 Jul 2023 07:44:45 GMT

Hi, I am building the playbook, where I have one task that is searching for incidents using the query as in:
!SearchIncidentsV2 query="type:FireEye NX Alert and fireeyenxalertvictimip:11.11.11.11 or 134.122.90.162"

With a help of community members I was able to insert the variable IP which contains a list of IP addresses to search for (above these are hardcoded) and receive a result in War Room:

The next step is to show this table in a layout (but not using notes or evidence)? I know I need to write an automation for this, but couldn't find something similar to guide me. Also I would like to know, how some sections in layout are created, e.g. indicators?

Re: War Room Table to Layout view

gyldz — Thu, 20 Jul 2023 08:10:24 GMT

Hi @MMagdic,

You can do this using grids or dynamic sections. Please watch the below video to learn how dynamic sections work. There is also another one on Incident Layout.

https://www.youtube.com/watch?v=j3JRo5bgerU&t=482s
https://www.youtube.com/watch?v=Ze_SI6axXj0

If you want to add them using a grid, you need to follow the below steps:

1. Create an incident field with a grid type and define all the columns you will use.
2. Use GridFieldSetup task in playbook to define your values and columns that are the result of SearchIncidents
3. Edit your layout to add the grid field you created.

I hope my answer helps you.