topic Arcsight base event to layout in Cortex XSOAR Discussions

Arcsight base event to layout

MKececioglu — Wed, 18 May 2022 13:28:50 GMT

Hi,

My Playbook is able to get arcsight events those related to a correlation (alarm) but i need to visualize these base events into layout tab but cant find a proper way. Do you have any suggestion ?

Regards.

Re: Arcsight base event to layout

jfernandes1 — Thu, 19 May 2022 02:28:21 GMT

Hi @MKececioglu,

Method 1: Create a markdown field. Use the ToTables function to populate the data in the field. (Easiest + table looks nicer)

Method 2: Create a GridField and use the setGridField automation to populate the data in the field. (Can be resized and sortable(I think))

Method 3: If you want a graph. You can use the dynamic section with a script to populate the data. https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/widgets/create-a-custom-widget-using-an-automation-script#idc003596e-0361-4cd5-b9eb-d21f57ffe258

Warnings: It is not recommended to put large amount of information into a field. This will directly affect your incident load times and index sizes.

Recommended Method - Use the ToTables function to send the output to the warroom. Mark the output as evidence. Ask your analyst to view this information on the evidence board.

Re: Arcsight base event to layout

jfernandes1 — Mon, 23 May 2022 05:26:56 GMT

Hi @MKececioglu, If the above solution worked for you. Please mark this as solved. Thanks.

Re: Arcsight base event to layout

MKececioglu — Mon, 23 May 2022 07:38:25 GMT

Hi @jfernandes1 ,

This method is worked for me, thank you for your support.

Method 1: Create a markdown field. Use the ToTables function to populate the data in the field. (Easiest + table looks nicer)