topic Re: Dynamic Section using Context in Cortex XSOAR Discussions

Dynamic Section using Context

Moh.Yasser — Fri, 03 Nov 2023 14:47:12 GMT

I was wondering how we can add splunk results into Incident layout. Possibly a CSV file or markdown.

We use splunk to search our email logs to see other recipients who got phishing email. Wanted to display that in the Incident layout.

Any advise is highly appreciated. Thank you.

Re: Dynamic Section using Context

MBeauchamp2 — Fri, 03 Nov 2023 15:02:26 GMT

Assuming you've run the search and the results are in context (usually under Splunk.Result), then yes you can use a dynamic section on your Incident layout to display the results in Markdown format.

Those are a type of automation, and there is a super awesome training video that explains how to write your own (video 19):

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success-engineering-training-video/ta-p/484604

There are also some useful examples of dynamic sections in the Case Management Pack that you can use as a reference: (CaseMgmtAnalystTools, CaseMgmtDisplayLabels, CaseMgmtResponseProcess) - https://cortex.marketplace.pan.dev/marketplace/details/CaseManagementGeneric/

Re: Dynamic Section using Context

Moh.Yasser — Fri, 03 Nov 2023 15:16:39 GMT

@MBeauchamp2 Thank you.

I found the results. Would I be able to attach the file in the layout? After exporting to CSV?

Re: Dynamic Section using Context

MBeauchamp2 — Fri, 03 Nov 2023 15:27:44 GMT

Dynamic sections won't display a file to be downloaded, it's more displaying in a markdown table for review via the XSOAR UI.

If you want a file then you could use the ExportToCSV automation to export it, and then in the layout there is a Incident Files or Incident Attachments section that they could grab it from.

Or you could tag the file entry in the war room (Details Tab on the Task) and use the War Room Entries section to display entries with that tag.