Arcsight base event to layout

[MKececioglu]

Hi,

My Playbook is able to get arcsight events those related to a correlation (alarm) but i need to visualize these base events into layout tab but cant find a proper way. Do you have any suggestion ?

Regards. 

[jfernandes1 · Accepted solution]

Hi @MKececioglu, 

Method 1: Create a markdown field. Use the ToTables function to populate the data in the field.  (Easiest + table looks nicer) 

Method 2: Create a GridField and use the setGridField automation to populate the data in the field. (Can be resized and sortable(I think))

Method 3: If you want a graph. You can use the dynamic section with a script to populate the data. https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/widgets/create-a-custom...

Warnings: It is not recommended to put large amount of information into a field. This will directly affect your incident load times and index sizes. 

Recommended Method - Use the ToTables function to send the output to the warroom. Mark the output as evidence. Ask your analyst to view this information on the evidence board. 

[jfernandes1]

Hi @MKececioglu, If the above solution worked for you. Please mark this as solved. Thanks.

[MKececioglu]

Hi @jfernandes1 ,

This method is worked for me, thank you for your support.

Method 1: Create a markdown field. Use the ToTables function to populate the data in the field.  (Easiest + table looks nicer)