topic Re: Add a war room filter for the main account tennant. in Cortex XSOAR Discussions

Add a war room filter for the main account tennant.

aborgoENGIE — Thu, 03 Dec 2020 11:37:06 GMT

Hello all,

We're trying to edit the layout of an incident in the Main Account tennant in order to display output of splunk searches.

When adding the "War Room" section in the layout we're asked to select a war room filter from existing list (see below screenshot).

But as we're on the main tennant we can't go to the playground war room and add a filter.

Here is the filter in the playground war room of an other tennant :

So how can we add war room filter inside the Main Account tennant which doesn't have a playground ?

Thanks for reading.

Best regards,

Alexandre Borgo

Re: Add a war room filter for the main account tennant.

OriNahir — Thu, 03 Dec 2020 18:32:04 GMT

Alexandre Borgo

Thank you for reaching out, we do have a gap here, however what you can try is the following:

Create the layout in one of the tenants - this will allow you to create the filter in the tenant playground, and to use this filter in the layout builder

once the layout is ready, you can export it from the tenant and import it to the main account, and than sync it to the rest of the tenants

give it a go, and let us know if that works for you

Ori

Re: Add a war room filter for the main account tennant.

aborgoENGIE — Fri, 04 Dec 2020 07:47:57 GMT

Hello Ori,

The solution worked well, thank you for the help.

Best regards