Identify Manual Cases Using Filter - Layout Rules

[michaelsysec242]

Hello Livecomm,

I am working on the XSIAM platform and I want to provide a default layout for cases that are manually opened. The classic fields that contain this info such as _product and tags cannot be filtered on.

Does anyone have a solution for this?

Many thanks,

MSysec

Cortex XSIAM 

[susekar]

Hello @michaelsysec242 ,

Greetings for the day.

In Cortex XSIAM, you can provide a default or specific layout for manually opened cases by utilizing Incident Layout Rules in conjunction with Custom Incident Fields. Since certain system fields like tags or _product may have filtering limitations in the layout rule engine or exhibit known UI issues, the most reliable solution is to create a dedicated custom field to trigger your desired layout.

 

Recommended Solution: Custom Field Workaround

To apply a specific layout to manual cases when system filters are not working as expected, follow these steps:

1. Create a Custom Incident Field

Create a field that will act as the trigger for your manual case layout.

Navigate to:

Cases & Issues → Case Configuration → Incident Fields

Create a new field (for example, Manual_Case_Type) with a type such as:

• Short Text, or

• Single Select

This field will be used in your layout rule condition.

 

2. Build the Custom Incident Layout

Design the layout you want to display for manually created cases.

Navigate to:

Cases & Issues → Case Configuration → Incident Layouts

• Create a new layout.

• Add the sections, tabs (such as Key Assets, Alerts & Insights), and fields you want to display.

• You can hide or reorder default tabs such as the Incident War Room or Timeline if needed.

 

3. Define an Incident Layout Rule

Create the rule that applies your layout based on your custom field.

Navigate to:

Cases & Issues → Case Configuration → Incident Layout Rules

• Create a new rule.

• Set the condition to use your custom field (for example, Manual_Case_Type equals Manual).

• Select your custom layout as the layout to apply.

Important:
Layout rules are evaluated from top to bottom. The system applies the first matching rule, so ensure your new rule is ordered correctly in the list.

 

4. Populate the Field During Case Creation

When manually opening a case, make sure the trigger field is populated.

If the custom field is included in the default case creation form:

• Set it to the value defined in your rule (for example, Manual).

• The correct layout will be applied immediately upon case creation.

 

Context on Field Limitations:

• Tags / Data Source: Data source information is often stored as tags, which may not be consistently supported for filtering in certain configuration engines or datasets.

• Filtering Issues: There are known UI issues in some versions where tag-based filtering may not populate correctly or return expected results.

• Incident Name Field: Although layout rules can be based on Incident Name, some versions have exhibited inconsistent behavior with this field, making custom fields a more stable and predictable option.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar